docs(attachment): correct the defuse loop's termination argument

[dwin-gharibi]

maxDefusePasses justified its bound with "each pass strictly shortens the body". That is false —
the placeholder is longer than the delimiters it replaces, so a pass usually grows the body.
The loop is fine; the stated reason it works is not.

Closes #4054.

Behaviour is unchanged

No production logic is touched. This corrects reasoning and adds a test that pins it.

What was wrong

One. maxDefusePasses:

Each pass strictly shortens the body (a match is always longer than nothing and is replaced by
a constant)

delimiterPlaceholder is 41 bytes; </document-x> is 13. Measured:

pass 1: len 13 -> 42   (GREW)
pass 1: len 26 -> 43   (GREW)

Two. defuseDelimiters:

</TAG</TAG>> collapses to […removed]> only after the second pass

envelopeTagRe runs to the first >, so that whole prefix is one match and collapses in one
pass. Verified: the residue shape is already stable after pass 1.

The real argument

delimiterPlaceholder contains neither < nor >, so it can never form part of a new match.
Every pass therefore strictly reduces the count of delimiter-shaped tokens in the body, and that
count is a non-negative integer — so the loop reaches a fixed point. The bound is belt-and-braces,
not the guarantee.

Why this matters more than a typo

defuseDelimiters returns whatever it has when the bound is hit — silently, no error. The
placeholder's character set is therefore load-bearing, and nothing said so. A cosmetic change to
something like <removed> would break the invariant, let the loop exhaust its bound, and return
a live delimiter inside the envelope — the exact break-out the escaping exists to prevent.

Tests

A comment can drift again; a test cannot. defuse_convergence_test.go adds:

• TestDelimiterPlaceholderCannotFormAMatch — fails if the placeholder ever gains angle brackets
  or starts matching envelopeTagRe.
• TestDefuseDelimitersConverges — 15 adversarial bodies (deep nesting, split brackets, mixed
  case, trailing attributes, self-closing, whitespace padding, prefix-extending tags, a body
  pre-seeded with the placeholder). Each must reach a fixed point inside the bound and leave
  no live delimiter. Convergence is asserted separately from survivor-freedom because hitting the
  bound is silent, so a regression there would otherwise only surface much later as a break-out.

The tripwire was mutation-tested rather than assumed: setting
delimiterPlaceholder = "<docker-agent: envelope delimiter removed>" makes it fail with

delimiterPlaceholder must contain no angle brackets, or the convergence argument
for maxDefusePasses no longer holds

pkg/attachment passes and go vet is clean.

Confirmed not a security fix

Eighteen adversarial inputs were probed before filing; all were fully defused with zero survivors.
There is no break-out to fix here, and this PR should not be read as one.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.