fix: reject padded component refs

[intel352]

Summary

• reject surrounding whitespace before validating provider component refs
• apply the same surrounding-whitespace guard to generic component refs
• add service and node-service regression tests for padded component_ref values

Verification

• GOWORK=off go test ./... -count=1
• GOWORK=off go vet ./...
• GOWORK=off go build ./...
• wfctl plugin validate-contract .
• goreleaser check

Adversarial Review

• Scope gate: dispatch required preserving workflow-compute service/node-service component_ref strictness after aliasing compute-core; PR adds the missing upstream guard and matching regressions.
• Bug-class scan: checked shortcut fix, one-sided boundary wiring, missing edge cases, symmetry, test-name/body mismatch, cross-platform, and error-shape risk. No Critical/Important findings. The generic validateComponentRef guard is intentional symmetry with provider component refs so WASM/content/artifact refs do not trim and accept padded values.
• Verdict: SHIP-IT — bounded upstream validation fix with focused regressions and no blocking findings.

[Copilot]

Pull request overview

This PR tightens protocol validation by rejecting component_ref values that include any leading/trailing whitespace (rather than silently trimming), and adds regression tests to ensure service and node-service workloads enforce the stricter behavior.

Changes:

• Reject component_ref values with surrounding whitespace in both provider-specific and generic component-ref validators.
• Preserve existing “no whitespace/NUL anywhere” rules while preventing whitespace-padding from being accepted via trimming.
• Add regression tests covering whitespace-padded component_ref for ServiceWorkload and NodeServiceWorkload.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
protocol/types.go	Updates component ref validation to reject surrounding whitespace before further validation.
protocol/types_test.go	Adds service and node-service regression tests ensuring padded component_ref is rejected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.