test(cpp): add sink-based protobuf model tests and trim comments

Replace the step-coverage function with one sink test per model row
using a template source, declare the Cord overloads of the ToString
methods in the stub, drop the incorrect istream comment from the
fixture, and shorten the model-file and change-note comments per review.

Author: kumarak

cpp/ql/lib/change-notes/2026-08-27-protobuf-models.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* Added flow summaries for the Protocol Buffers C++ API (`google::protobuf::MessageLite`, covering `Message` and all generated messages).
+* Added flow summaries for the Protocol Buffers `google::protobuf::MessageLite` C++ API.

cpp/ql/lib/ext/Protobuf.model.yml

@@ -3,16 +3,10 @@ extensions:
       pack: codeql/cpp-all
       extensible: summaryModel
     data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
-      # Flow summaries for the Protocol Buffers C++ API. All of these methods are declared on
-      # `google::protobuf::MessageLite`; `subtypes` covers `Message` and every generated message.
-      #
       # File-descriptor variants (`{Parse,Serialize}*FromFileDescriptor`) are intentionally omitted:
       # the descriptor is an `int`, not a data buffer, so there is no buffer argument to model.
 
-      # Deserialization: the encoded input taints the message (`this`). The `*FromString` methods each
-      # have a `string_view` overload (the buffer is the by-value argument, so `Argument[0]`) and a
-      # `const Cord &` overload (the buffer is behind a reference, so `Argument[*0]`). The remaining
-      # inputs below are pointers or references, so they take `Argument[*0]`.
+      # Deserialization
       - ["google::protobuf", "MessageLite", True, "ParseFromString", "(string_view)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "ParseFromString", "(const Cord &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "ParsePartialFromString", "(string_view)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
@@ -40,7 +34,7 @@ extensions:
       - ["google::protobuf", "MessageLite", True, "MergeFromCodedStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "MergePartialFromCodedStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
 
-      # Serialization into an output buffer/stream: the message (`this`) taints `Argument[*0]`.
+      # Serialization
       - ["google::protobuf", "MessageLite", True, "SerializeToString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "SerializePartialToString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "AppendToString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
@@ -58,7 +52,7 @@ extensions:
       - ["google::protobuf", "MessageLite", True, "SerializeToCodedStream", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "SerializePartialToCodedStream", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
 
-      # Serialization returning the bytes: the message (`this`) taints the (by-value) return value.
+      # Serialization returning bytes
       - ["google::protobuf", "MessageLite", True, "SerializeAsString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "SerializePartialAsString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
       - ["google::protobuf", "MessageLite", True, "SerializeAsCord", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]