fix: fail-closed localization allowlist and serialize vLLM kv-transfer JSON

[siliangchen-amd]

Description

Two independent fixes. No change to the session breakdown contract.

1. When localization had no trusted write root, _localization_paths_outside_allowlist() returned [], which the caller reads as "no violations" and applies the diff. With no root, no path can be proven in-bounds, so every non-empty touched path is now reported as out of bounds. The caller already reverts on a non-empty list (localization_outside_allowlist). This is defensive: resolve_source_file_allowlist() / _merge_roots() only drop blanks and duplicates and never check that directories exist, so the five static default roots are always present, and the call site also appends framework_root. The production path does not reach the empty-root branch today.
2. The vLLM PD --kv-transfer-config JSON was built with an f-string, and --pd-transfer-backend is free text (no choices=). A connector name containing a quote produced illegal JSON that only failed when the remote vllm serve parsed it, and a value shaped like NixlConnector","kv_buffer_size":"1000000000 produced valid JSON carrying an extra field with no error at all. The config is now built with json.dumps(). Unknown connector names log a warning and still pass through so a future vLLM connector is not blocked. The shell layer was already safe (shlex.quote per argv); this is the JSON layer.

Linked issue(s)

None.

Tests

• With no trusted root, every touched path is reported out of bounds; framework_root alone still admits paths inside that tree
• A connector name containing a quote round-trips through json.loads as a single escaped field; default prefill / decode roles unchanged
  90 passed on the targeted tests. ruff check / ruff format --check on the changed files passed.

Breaking changes

No. Localization with no trusted root now reverts instead of applying. The vLLM PD launch argv is unchanged for well-formed connector names; malformed names stay one escaped field instead of breaking or injecting JSON.

[github-actions]

CI E2E report — ❌ Timeout

item	value
result	❌ Timeout
model	Qwen/Qwen3-0.6B (dense)
resources	1× GPU, TP=1
PR branch	bugfix/siliang/allowlist-failclosed-kv-transfer-json
commit	51d1ea50a9148d9d37f2bb9e500b4d66f07aafa0
session_id	82a372eb-46ce-4922-b276-27ffd3338631
queue → dispatch	-40529s
run time	701m 22s
total	25m 53s
reason	Timed out — the run never reached a terminal state in time (task stuck, or the GPU stayed queued too long).
detail	not terminal after 13200s

details