fix(policy): avoid panic truncating multi-byte UTF-8 paths for display

[andrewwhitecdw]

Summary

truncate_for_display in openshell-policy sliced over-long strings at a fixed byte index (&s[..77]), panicking when the index lands inside a multi-byte UTF-8 character. A policy YAML with a filesystem path longer than MAX_PATH_LENGTH (4096) containing multi-byte characters crashes the sandbox supervisor and OPA policy loader instead of producing the intended FieldTooLong policy violation.

Related Issue

N/A — small fix found during code review. Same bug class as #2406 (byte-index slicing on possibly multi-byte strings).

Changes

• truncate_for_display backs off to the nearest char boundary before slicing
• Added regression tests: multi-byte input no longer panics; short strings pass through unchanged

Testing

• mise run pre-commit passes (mise unavailable in this environment; ran equivalent cargo fmt + cargo clippy -p openshell-policy --all-targets — clean)
• Unit tests added/updated (cargo test -p openshell-policy truncate_for_display — 2 passed)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @andrewwhitecdw.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}