fix(policy): validate standalone constraints

[Benoît Cortier (CBenoit)]

• validate standalone PolicyConstraints values through PolicySerializer.Serialize<T> and DeserializeStrict<T>
• reuse the same four bounded-string checks used for constraints nested in policy rules
• enforce the checks through direct JsonSerializer use with public PolicySerializer.Options and StrictOptions
• cover all four collections at empty, maximum, and maximum+1 Unicode-scalar lengths across generic helpers and public options

This is an immediate follow-up to merged #99 for the late Copilot review and its specific finding.

BrokerSerializer needs no additional change: its supported generic APIs expose broker DTO roots, whose embedded policy documents already traverse PolicySerializer validation. It does not expose standalone PolicyConstraints through its generic helper surface.

Changelog: ignore

[Copilot]

🟢 Approval recommended

The focused change correctly closes the validation gap with comprehensive boundary coverage.

Pull request overview

Adds standalone PolicyConstraints validation consistent with nested policy rules.

Changes:

• Reuses bounded-string validation for standalone constraints.
• Adds boundary tests across generic helpers and public serializer options.

File summaries

File	Description
PolicySerializer.cs	Validates standalone constraint collections.
PolicyTests.cs	Tests empty, maximum, and over-limit values.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.