fix(reliability): bound accessibility string metadata before normalization

[seonghobae]

Buyer-visible reliability boundary

Protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e exposes host-supplied accessibility strings that cross an untyped/deserialized runtime boundary before they are normalized and reflected into editor/ARIA attributes. The historical defect allowed non-string values to leak accidental native string-operation failures and allowed arbitrarily large metadata to force normalization plus DOM attribute materialization.

This is an Inkspan-owned local editor/accessibility resource boundary. It does not validate host DOM ownership, localization policy, authentication, transport, tenancy, persistence, credentials, model/provider behavior, or durable audit.

Canonical owner and implemented contract

Draft PR #230 is now the sole active writer for src/components/editorAccessibility.ts and its focused metadata/runtime tests. Do not create a separate main-based writer for this issue.

At exact #230 head 59d82f8b65cfad5230fa9e11afb97867293a43f5, all host-supplied accessibility strings handled by the helper—including required defaultLabel as well as optional placeholder, languageTag, ariaLabel, ariaLabelledBy, ariaDescribedBy, and ariaErrorMessage—are bounded to 65,536 UTF-16 code units and non-string runtime values are rejected through a stable payload-redacted RangeError before normalization. Optional strings preserve existing trim/blank-omission semantics; required defaultLabel preserves its existing spelling semantics rather than being silently normalized.

Representative resource-boundary RED lineage is 8b3d7d9959d0c01c63aa2da1cad5a7756ea31985; required fallback-label coverage was added at test-only f6aa305d62f9f6715a4730eb77f4ab8c07418248 and immediately followed by the narrow implementation. Exact-current #230 repository workflows are terminal success: CI 32322070195, Security Scan 32322070146, and SAST Semgrep 32322070224. Predecessor evidence does not transfer.

Acceptance

1. Reject non-string and oversized accessibility metadata before string normalization or DOM-attribute materialization with stable payload-redacted diagnostics.
2. Preserve optional whitespace normalization, blank omission, accessible-name precedence, placeholder mirroring, language/direction behavior, boolean/enum ARIA states, and required fallback-label spelling semantics.
3. Do not truncate, hash, infer, canonicalize, or echo rejected values. The 65,536-code-unit ceiling is a local resource policy, not a WAI-ARIA or BCP 47 standard maximum.
4. Add no host validation policy, transport, persistence, authn/authz, tenancy, credentials, model/provider, network, deployment, migration, retention, or durable-audit authority.
5. Maintain exact owned-production coverage and all applicable package/browser/Office/security gates on the eventual integration head.
6. Close only when canonical fix(accessibility): harden editor metadata runtime contracts #230 integrates into protected main; Draft/head-green evidence is not protected shipped truth.

Integration boundary

Keep #230 Draft/unmerged while #118 freezes protected main for v0.6.0 operational acceptance and while qualifying independent approval plus every then-live merge/review/governance gate remain incomplete. Never transfer predecessor CI/review evidence or create a competing writer for the same source.