Neutralise CR and form feed in CSS variable export strings

Found while testing crates/engine/src/cmd/variables_io.rs:~92 (css_safe, used by css for String values and mode names)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

crates/engine/src/cmd/variables_io.rs

@@ -62,7 +62,7 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// `text` as a CSS comment or quoted string body.
 fn css_safe(text: &str) -> String {
-    text.replace("*/", "* /").replace(['"', '\\', '\n'], " ")
+    text.replace("*/", "* /").replace(['"', '\\', '\n', '\r', '\u{c}'], " ")
 }
 
 /// Each collection's variables as custom properties (named as generated code names them): the

crates/engine/src/variables_io_tests.rs

@@ -513,3 +513,15 @@ fn review_a_long_alias_chain_keeps_its_role_to_the_end() {
     let css = ex(&mut s, "variable.export", json!({"format": "css"}))["text"].as_str().unwrap_or_default().to_string();
     assert!(css.contains("--o0: 0.5;"), "{css}");
 }
+
+#[test]
+fn css_export_neutralises_every_css_newline_in_strings() {
+    let mut s = Session::new();
+    ex(&mut s, "variable.createCollection", json!({"name": "Brand"}));
+    ex(&mut s, "variable.create", json!({"collection": "Brand", "name": "t", "type": "string", "value": "a\rb\u{c}c"}));
+    for format in ["css", "tailwind"] {
+        let css = ex(&mut s, "variable.export", json!({"format": format}))["text"].as_str().unwrap_or_default().to_string();
+        assert!(!css.contains('\r') && !css.contains('\u{c}'), "{css:?}");
+        assert!(css.contains("\"a b c\""), "{css:?}");
+    }
+}