The old sanitiser mapped '/', ':' and space -- and every other unsafe
byte -- all to '_', so "a/b" and "a:b" both became "a_b" and silently
shared one palettes/<name>.json + themes/<name>.css, last writer wins.
No collision detection at all.
Percent-encode every byte outside [A-Za-z0-9._-] as %XX instead. That is
injective, so two connectors can never land on the same file. '%' itself
isn't in the keep-set so it encodes to %25 and the mapping stays
reversible in principle (nothing decodes today -- reload_binds_for_
sanitized only compares sanitize_output(name) against the on-disk stem).
Real Hyprland connectors (eDP-1, HDMI-A-1, DP-2) are already only
keep-set bytes, so their filenames are unchanged; the files are
session-scoped under XDG_RUNTIME_DIR and regenerated at login anyway.
c7c579bf04