ci(ai-validation): fix control-char guard — use grep -z, exclude NUL

Previous form `tr -d '\0\n\r' | grep -Pq [\x00-\x1F\x7F]` stripped
the very chars (LF, CR) it was meant to catch before the grep ran,
so a path containing newlines or carriage returns slipped through.

`grep -z` keeps NUL as the record delimiter (legitimate separator from
git diff -z) and the pattern excludes 0x00 while catching every other
control byte 0x01-0x1F + 0x7F. LF/CR inside any path now correctly
fail the guard.

Surfaced by Copilot on #1969; applied to all three branch copies
(rolling/circinus/sagitta) so the workflow stays in sync.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 8 insertions, 2 deletions

diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml
index 1265b789..ea16a4fb 100644
--- a/.github/workflows/ai-validation.yml
+++ b/.github/workflows/ai-validation.yml
@@ -77,9 +77,15 @@ jobs:
           # coverage on the real file (or worse, attempt to act on a synthetic
           # path). Filesystems and porcelain git typically reject these but a
           # fork PR can still commit such a tree entry; fail fast.
+          # grep -z treats NUL as the record delimiter (NUL is a legitimate
+          # separator here, not a forbidden char). The pattern excludes
+          # 0x00 and rejects every other control byte 0x01-0x1F + 0x7F,
+          # so LF (0x0A) and CR (0x0D) inside a path are caught.
+          # An earlier `tr -d '\0\n\r' | grep [\x00-\x1F\x7F]` form would
+          # strip the very chars it was meant to reject before the grep
+          # ran — defeating the guard.
           for z in changed-md.z changed-rst.z; do
-            if LC_ALL=C tr -d '\0\n\r' < "$z" \
-                | LC_ALL=C grep -Pq '[\x00-\x1F\x7F]'; then
+            if LC_ALL=C grep -zPq '[\x01-\x1F\x7F]' "$z"; then
               echo "::error::Refusing to bundle: path in $z contains a control character. Reject the offending file name in the PR."
               exit 1
             fi