scripts/drills/run.ts refuses to send the admin token to a plain-http forge that is not loopback, and strips control characters from what it prints #2202

From the last review of pull #1974. Its script reached main through #2179, but these asks did not.

Done looks like:

• [ ] --forge http://… with a host other than localhost, 127.0.0.1 or ::1 exits 2 with one plain line and sends nothing. The only way past it is an explicit --insecure.
• [ ] The argument checks move into an exported checkArgs(argv, env, isTTY) that returns either the options or an error. Tests cover a missing domain, a missing --forge, an empty FORGE_TOKEN, stdin that is not a TTY, and the cleartext refusal.
• [ ] Text the script echoes from the forge (health, board) has its C0/C1 control characters removed (tab is kept) before it is printed or posted. One test sends an ANSI escape and checks it is gone.
• [ ] One line in the README points to the script where POST /api/v1/drills is documented.

Files: scripts/drills/run.ts, test/drills-run.test.ts (or the existing test for the script), README.md. Risk: none outside the script. It is a CLI and has no page. Brief: scout.