fix: assorted small validation and robustness fixes

[andrewwhitecdw]

Summary

Three small, independent robustness fixes found during code review, one commit each:

1. server: Kubernetes label key/value validation used Unicode-aware is_alphanumeric(), so labels like café or 日本語 passed gateway validation but would be rejected by the Kubernetes API server (the label spec is ASCII-only). The same functions already validate the key prefix with ASCII-only checks.
2. cli: two display paths in sandbox policy commands sliced server-supplied strings unguarded — &resp.policy_hash[..12] (panics on empty/short proto3 hash; a guarded short_hash() helper already existed nearby) and &rev.load_error[..40] (panics on multi-byte UTF-8, same bug class as fix(cli): avoid panic on multi-byte UTF-8 in --since duration #2406).
3. sandbox: the ephemeral-port advisory check used port > 49152, omitting port 49152 itself from the IANA dynamic/private range (49152–65535 inclusive).

Related Issue

N/A — small fixes found during code review.

Changes

• validate_label_key/validate_label_value: use is_ascii_alphanumeric(); added Unicode rejection tests
• sandbox_policy_set: use existing short_hash() helper instead of unguarded slicing
• Policy revision table: back off to a char boundary when truncating load_error
• mechanistic_mapper: port >= 49152 for the ephemeral range note

Testing

• mise run pre-commit passes (mise unavailable in this environment; ran equivalent cargo fmt + cargo clippy on all touched crates — clean)
• Unit tests added/updated (cargo test -p openshell-server validate_label — 40 passed, incl. 2 new)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @andrewwhitecdw.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}