Conformance: the remaining producer-controlled interpolations rely on the sink cut alone

[Tim81]

#403 bounds every retained PreflightAssertion.Message at PreflightContext.MaxMessageChars (1024 characters), and excerpts the producer value through DiagnosticExcerpt.Quote at ten sites: the /Filter name in StreamRule, the action type and named action in ActionRule, the /Subtype label and the extra /AP key in AnnotationRule, the composite font's /Encoding CMap name in FontStructureRule, the /RoleMap key in LogicalStructureRule, the /Perms key in PermissionsRule, the blend mode in BlendModeRule and the CMap name in UaCMapRule.

Every other producer-controlled interpolation in src/VellumPdf.Conformance/Rules/** relies on the sink cut alone. Retention is bounded, but for a value over about 1000 characters the sentence is cut mid-value and its tail (the clause reference, the "shall be one of" list) is lost. Measured on the #404 branch through PdfPreflight.Validate: a 1 MiB font /Subtype gives a 1043-character ISO19005-2:6.2.11.2-font-subtype message whose "; it shall be one of the font subtypes defined in ISO 32000-1." is gone; a 200 000-character UTF-16BE /Lang gives a 1042-character ISO19005-2:6.7.4-1 message.

Sites found by the #404 round-1 reviewers (line numbers at 74b5ee4), all PdfName.Value or a producer string:

• Fonts/FontStructureRule.cs:182, :219, :226, :267, :389, :390, :507
• Fonts/FontEmbeddingRule.cs:102 (name, reused by five messages)
• Fonts/ToUnicodeRule.cs:52
• Fonts/CMapContentRule.cs:225, Ua/UaCMapRule.cs:146 (referencedName)
• Graphics/ContentStreamOperatorRule.cs:198 (op)
• Graphics/InlineImageFilterRule.cs:300 (filterName)
• Graphics/InheritedResourceRule.cs:501 (resourceName)
• Graphics/GraphicsStateRule.cs:162, :172, :180 (colorantName, intent)
• Colour/DeviceNColorantsRule.cs:131, Colour/SeparationConsistencyRule.cs:430
• Structure/NameUtf8Rule.cs:204, Structure/A2aStructureTypeRule.cs:97 and three siblings (rawType, target)
• Structure/A2aLangSyntaxRule.cs:90, Ua/UaLangSyntaxRule.cs:77 (langStr)
• Metadata/PropertyUsageRule.cs:114 (ns), Metadata/ExtensionSchemaRule.cs:325, :355, :384
• Ua/UaFontEmbeddingRule.cs:184, Ua/UaCidToGidMapRule.cs:72, Ua/UaSymbolicFontRule.cs:73, Ua/UaTrueTypeCmapRule.cs:153, :192
• Ua/UaAnnotContentsRule.cs:96, Ua/UaAnnotStructureRule.cs:208, Ua/UaNaturalLanguageRule.cs:209 (an annotation label built once and reused, the AnnotationRule pattern)
• Ua/UaListContainmentRule.cs:80, Ua/UaTableContainmentRule.cs:91-121 (parentSt, nine messages)
• Ua/UaRoleMapRule.cs:79, Ua/UaNoteIdRule.cs:97

Not in the list on purpose: AnnotationRule.cs:63 (the subtype must be a member of _forbiddenSubtypes, so at most 9 characters) and NumericLimitsRule.cs:68 (drawn from the fixed _boundaryBoxes set).

Proposed shape: DiagnosticExcerpt.Quote before interpolation at every site above, one exact-message test per site at a 1 MiB value in PreflightMessageBoundTests, and the same byte-identity proof #404 gave (a value of 32 characters or fewer reconstitutes the previous string character for character; Conformance and Cli suites unchanged with oracles). Conformance is Shipped, so the message-text change gets a ### Changed CHANGELOG bullet paired with the ### Fixed one, as #403 did. Producer strings (/Lang, XMP property names) need a decision on whether "bytes" is the right unit word for a value decoded from UTF-16BE; Quote(string) counts characters and labels them bytes, which is exact for a Latin-1 PdfName.Value and not for those.