kubescape-backlog-bridge: report() renders titles unsanitized and unbounded, so the preview differs from what write files #2924

🤖 Generated by the Agentic Engineer

Evidence

Found while doing the user evaluation for #2917 — running the real command against live cluster data,
not by reading the code.

The two modes render the title through different paths:

Reproduced against a real workloadconfigurationscansummaries object from admin@prod, with its
control key replaced by a 1400-character id:

rendered title runes = 1432
ends with ellipsis   = False

The same theme through the write path renders 256 runes ending in ….

Affected audience and impact

Two distinct consequences, both small but real:

1. The preview does not preview. -mode report is how an operator sees what a write run would
   file. A title that differs between the two means the report is not a faithful dry run.
2. The report's TSV can be broken by untrusted input. report() emits tab-separated fields, and
   sanitizeForIssue is precisely what folds \r/\n into spaces. Because report bypasses it, a
   control key or CVE key containing a tab or newline would split a row and corrupt the output for
   anything parsing it. Scanner output is untrusted by this tool's own stated design premise, so
   "control ids are always C-0034-shaped" is an assumption the rest of the package deliberately
   refuses to make.

Not a security issue: report() writes to an io.Writer (stdout), never to a GitHub artifact, so
the unsanitized @-mention and backtick handling that matters for bodies does not apply here.

Expected behaviour

Report and write render a theme's title identically, through one function.

Smallest useful change

Have report() call renderTitle(t) instead of t.Title(). Both live in the same package.

Worth deciding deliberately rather than assuming: bounding the preview is arguably wrong if an
operator wants to see the full key. If so, the fix is to sanitize in report (closing consequence 2)
and to display the truncation explicitly, rather than silently rendering a different title from the
one that would be filed.

Acceptance criteria

• A theme's title is rendered by one function for both modes, or the divergence is documented
  with its rationale.
• A control/CVE key containing a tab or newline cannot break the report's TSV row structure;
  proved by a test with that input.
• The report of a theme whose title would be truncated on filing makes that visible.

Rough size

XS. Pre-existing — not introduced by #2917, which bounded only the write path because that is
where the failure it fixed occurs (an over-long title fails gh issue create and, via applyPlan's
stop-at-first-failure, blocks every remaining action in the run).