Request validation and resilience improvements (#864)

### Security: Input validation & path safety
- **Reject local file references by default** in package parsing — only allow when explicitly opted in by the service (`ParseFlags::kAllowLocalReferences`) and validated by an `ILocalRefPolicy` (fail-closed: no policy = rejected)
- **`DataRootLocalRefPolicy`** restricts local ref paths to the server's data root via canonical path prefix matching
- **Validate attachment hashes** in compute HTTP handlers — decompresses and re-hashes each attachment at ingestion time to reject tampered payloads
- **Path traversal validation** for worker descriptions (`pathvalidation.h`) — rejects absolute paths, `..` components, Windows reserved device names, and invalid filename characters
- **Harden CbPackage parsing** against corrupt inputs — overflow-safe attachment count, bounds checks on local ref offset/size, graceful failure instead of `ZEN_ASSERT` for untrusted data
- **Harden legacy package parser** — reject zero-size binary fields, missing mappers, and optionally validate resolved attachment hashes
- **Bounds check in `CbPackageReader::MarshalLocalChunkReference`** — detect when `MakeFromFile` silently clamps offset+size to file size

### Reliability: Lock consolidation & bug fixes
- **Consolidate three action map locks into one** (`m_ActionMapLock`) — eliminates deadlock risk from multi-lock ordering, simplifies state transitions, and fixes a race where newly enqueued actions were briefly invisible to `GetActionResult`/`FindActionResult`
- **Fix infinite loop in `BaseRunnerGroup::SubmitActions`** when actions exceed total runner capacity — cap round-robin at `TotalCapacity` and default unassigned results to "No capacity"
- **Fix `MakeSafeAbsolutePathInPlace` for UNC paths** — `\server\share` now correctly becomes `\?\UNC\server\share` instead of `\?\server\share`
- **Fix `max_retries=0`** — previously fell through to the default of 3; now correctly means "no retries"

### New: ManagedProcessRunner
- Cross-platform process runner backed by `SubprocessManager` — uses async exit callbacks instead of polling, delegates CPU/memory metrics to the manager's built-in sampler
- `ProcessGroup` (JobObject on Windows, process group on POSIX) for bulk cancellation on shutdown
- `--managed` flag on `zen exec inproc` to select this runner
- Refactored monitor thread lifecycle — `StartMonitorThread()` now called from derived constructors to avoid calling virtual functions from base constructor

### Process management
- **Suppress crash dialogs** via `JOB_OBJECT_UILIMIT_ERRORMODE` + `SEM_NOGPFAULTERRORBOX` in both `WindowsProcessRunner` and `JobObject::Initialize` — prevents WER/Dr. Watson modal dialogs from blocking the monitor thread
- **CREATE_SUSPENDED → AssignProcessToJobObject → ResumeThread** pattern in `WindowsProcessRunner` — ensures job object assignment before process execution
- **Move stdout/stderr callbacks to `Spawn()` parameters** in `SubprocessManager` — prevents race where early output could be missed before callback installation
- Consistent PID logging across all runner types

### Test infrastructure
- **`zentest-appstub`**: Added `Fail` (configurable exit code) and `Crash` (abort / nullptr deref) test functions
- **Compute integration tests**: exit code handling, auto-retry exhaustion, manual reschedule after failure, mixed success/failure queues, crash handling (abort + nullptr), crash auto-retry, immediate query visibility after enqueue
- **Package format tests**: truncated header, bad magic, attachment count overflow, truncated data, local ref rejection/acceptance, policy enforcement (inside/outside root, traversal, no-policy fail-closed)
- **Legacy package parser tests**: empty input, zero-size binary, hash resolution with/without mapper, hash mismatch detection
- **UNC path tests** for `MakeSafeAbsolutePath`

### Misc
- ANSI color helper macros (`ZEN_RED`, `ZEN_BRIGHT_WHITE`, etc.) and `ZEN_BOLD`/`ZEN_DIM`/etc.
- Generic `fmt::formatter` for types with free `ToString` functions
- Compute dashboard: truncated hash display with monospace font and hover for full value
- Renamed `usonpackage_forcelink` → `cbpackage_forcelink`
- Compute enabled by default in xmake config (releases still explicitly disable)

1 files changed, 20 insertions, 3 deletions

diff --git a/src/zenserver-test/cache-tests.cpp b/src/zenserver-test/cache-tests.cpp
index 14748e214..986dc67e0 100644
--- a/src/zenserver-test/cache-tests.cpp
+++ b/src/zenserver-test/cache-tests.cpp
@@ -9,6 +9,7 @@
 #	include <zencore/compactbinarypackage.h>
 #	include <zencore/compress.h>
 #	include <zencore/fmtutils.h>
+#	include <zenhttp/localrefpolicy.h>
 #	include <zenhttp/packageformat.h>
 #	include <zenstore/cache/cachepolicy.h>
 #	include <zencore/filesystem.h>
@@ -25,6 +26,13 @@ namespace zen::tests {
 
 TEST_SUITE_BEGIN("server.cache");
 
+/// Permissive policy that allows any path, for use in tests that exercise local ref
+/// functionality but are not testing path validation.
+struct PermissiveLocalRefPolicy : public ILocalRefPolicy
+{
+	void ValidatePath(const std::filesystem::path&) const override {}
+};
+
 TEST_CASE("zcache.basic")
 {
 	using namespace std::literals;
@@ -743,7 +751,11 @@ TEST_CASE("zcache.rpc")
 
 		if (Result.StatusCode == HttpResponseCode::OK)
 		{
-			CbPackage Response = ParsePackageMessage(Result.ResponsePayload);
+			ParseFlags PFlags = EnumHasAllFlags(AcceptOptions, RpcAcceptOptions::kAllowLocalReferences) ? ParseFlags::kAllowLocalReferences
+																										: ParseFlags::kDefault;
+			PermissiveLocalRefPolicy AllowAllPolicy;
+			const ILocalRefPolicy*	 PPolicy  = EnumHasAllFlags(PFlags, ParseFlags::kAllowLocalReferences) ? &AllowAllPolicy : nullptr;
+			CbPackage				 Response = ParsePackageMessage(Result.ResponsePayload, {}, PFlags, PPolicy);
 			CHECK(!Response.IsNull());
 			OutResult.Response = std::move(Response);
 			CHECK(OutResult.Result.Parse(OutResult.Response));
@@ -1745,8 +1757,13 @@ TEST_CASE("zcache.rpc.partialchunks")
 
 		CHECK(Result.StatusCode == HttpResponseCode::OK);
 
-		CbPackage Response = ParsePackageMessage(Result.ResponsePayload);
-		bool	  Loaded   = !Response.IsNull();
+		ParseFlags				 PFlags = EnumHasAllFlags(Options.AcceptOptions, RpcAcceptOptions::kAllowLocalReferences)
+											  ? ParseFlags::kAllowLocalReferences
+											  : ParseFlags::kDefault;
+		PermissiveLocalRefPolicy AllowAllPolicy;
+		const ILocalRefPolicy*	 PPolicy  = EnumHasAllFlags(PFlags, ParseFlags::kAllowLocalReferences) ? &AllowAllPolicy : nullptr;
+		CbPackage				 Response = ParsePackageMessage(Result.ResponsePayload, {}, PFlags, PPolicy);
+		bool					 Loaded	  = !Response.IsNull();
 		CHECK_MESSAGE(Loaded, "GetCacheChunks response failed to load.");
 		cacherequests::GetCacheChunksResult GetCacheChunksResult;
 		CHECK(GetCacheChunksResult.Parse(Response));