fix(policy): avoid panic truncating multi-byte UTF-8 paths for display

[andrewwhitecdw]

Summary

truncate_for_display in openshell-policy sliced over-long strings at a fixed byte index (&s[..77]), panicking when the index lands inside a multi-byte UTF-8 character. A policy YAML with a filesystem path longer than MAX_PATH_LENGTH (4096) containing multi-byte characters crashes the sandbox supervisor and OPA policy loader instead of producing the intended FieldTooLong policy violation.

This PR supersedes #2408, which was auto-closed by the vouch-check workflow before I was vouched.

Related Issue

N/A — small fix found during code review. Same bug class as #2446 (byte-index slicing on possibly multi-byte strings).

Changes

• truncate_for_display backs off to the nearest char boundary before slicing
• Added regression tests: multi-byte input no longer panics; short strings pass through unchanged

Testing

• mise run pre-commit passes (mise unavailable in this environment; ran equivalent cargo fmt + cargo clippy -p openshell-policy --all-targets — clean)
• Unit tests added/updated (cargo test -p openshell-policy truncate_for_display — 2 passed)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[andrewwhitecdw]

I have read the DCO document and I hereby sign the DCO.

[github-actions]

Label test:e2e applied, but pull-request/2448 does not exist yet. A maintainer needs to comment /ok to test 2da2947774591e972811db09be1897a066c26169 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[johntmyers]

/ok to test 2da2947

[johntmyers]

gator-agent

PR Review Status

Validation: This is a valid, concentrated policy bug fix. It restores the intended FieldTooLong violation for overlong multi-byte filesystem paths instead of panicking. PR #2408 is the same author's vouch-closed predecessor, not an active competing implementation.
Head SHA: 2da2947774591e972811db09be1897a066c26169

Review findings:

• No blocking findings remain. The UTF-8 boundary search is bounded and preserves the existing display limit, and the regression test exercises the prior panic.

Docs: Not needed because this restores intended validation behavior without changing the policy schema, limits, commands, or documented workflow.

Testing: Applied test:e2e because the change affects policy enforcement, and posted /ok to test 2da2947774591e972811db09be1897a066c26169 to authorize the current head on NVIDIA runners.

Next state: gator:watch-pipeline

[github-actions]

Label test:e2e applied for 2da2947. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.