fix(process): preserve UTF-8 at diagnostic truncation boundaries - #8907

Problem

Byte-bounded command diagnostics can introduce replacement characters into valid UTF-8 output when the retained head or tail cuts through a multibyte character. For example, an eight-byte excerpt of A🙂...🙂Z shows broken emoji bytes around the omission marker. A one-shot StringDecoder.write() also hides some malformed bytes at the end of the retained head, such as 0xc0.

Changes

Decode the retained head after excluding only a suffix that could still become a valid UTF-8 code point. Preserve invalid lead bytes and already-invalid prefixes, including overlong encodings, surrogates, and values above U+10FFFF. Skip only the possible continuation-byte fragment at the cut edge of the tail. Raw retention stays within the existing byte budget.

Complete output is decoded after joining the head and tail. The non-truncated regression now uses A🙂, whose five-byte buffer is split inside the emoji by the three-byte head limit; every two-chunk split and bytewise append must reconstruct the exact original text.

The semantic owner is BoundedOutputExcerpt, shared by the bounded command runner's stdout/stderr diagnostics. This corrects an existing process-output boundary without adding an execution capability or changing byte limits, exit codes, or the tail policy.

Current validation

Head: 30aaca9bffbfad607bb008083f720120cf6024fc.

• The repository runner (node scripts/run-development-tests.mjs local src/process/BoundedOutputExcerpt.test.ts src/process/ExecFileBoundedOutput.test.ts) passed 29 tests / 0 failures on Node 24.22.1 / Vitest 5.0.3: 25 module cases plus the existing four subprocess tests.
• The same expanded tests against the previous head's source (ea26bd29891b3466297e86654e63978fb7de8a72) reported 9 failed / 20 passed, exposing the malformed-byte loss.
• A real subprocess probe using the reported malformed head preserved A� … [output omitted] … BZ in both stdout and stderr after the fix, with exit code 7 and truncation unchanged. The prior source lost the replacement character.
• Repository-pinned oxfmt 0.72.0 and oxlint 1.87.0, including the repository's custom lint plugins and --max-warnings 0, passed for both changed files. Targeted strict TypeScript 5.9.3 checking of the two modules and their tests, plus git diff --check, also passed.

The full project checks and real Hopper setup were not run locally. The hosted CI run 41866035849 has now completed successfully on this exact head, 30aaca9bffbfad607bb008083f720120cf6024fc.

Author readiness

Human owner: @Afloat16

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.