fix(supervisor-network): bound OPA policy load diagnostics

Report fixed validation categories with item and byte limits, preserving
safe YAML positions while discarding authored payloads and error chains.
Keep rejected L7 warnings out of diagnostics and cover load/reload paths,
omission behavior, and active-state retention with regression tests.

Align the parity fixture with the Debian supervisor base and separate
sandbox runtime image so current runtime validation has complete inputs.

Refs: #3092
Signed-off-by: Shiju <shiju@nvidia.com>

Author: shiju-nv

architecture/security-policy.md

@@ -70,9 +70,7 @@ proxy.
 | `foo.**.example.com` | No | — | Recursive wildcard outside the first label is not allowed. |
 | `foo**.example.com` | No | — | Recursive `**` mixed inside a label; allowed only as the entire first label. |
 
-Validation rejects the disallowed patterns at policy load time with a message
-that names the offending host. Exact hosts and IP addresses do not use this
-path.
+Validation rejects the disallowed patterns at policy load time. OPA load errors omit the supplied hostname. Exact hosts and IP addresses do not use this wildcard-validation path.
 
 ## TLS and L7 Inspection
 
@@ -182,6 +180,14 @@ configure the separately isolated supervisor. When a supervisor override is
 combined with injected provider credentials, the supervisor emits a
 high-severity detection finding at startup naming the inactive controls.
 
+## Policy Load Diagnostics
+
+`OpaEngine` bounds the error messages returned when loading or reloading policy from files, strings, or protobuf. Each message contains at most eight error items and 512 UTF-8 bytes, including its heading, separators, and any `additional violations omitted` marker. The loader reports complete, fixed categories and discards authored names, values, paths, source snippets, and nested error chains.
+
+Typed validation categories distinguish process identity, filesystem paths and limits, Landlock compatibility, endpoint hosts and ports, credential signing and rewriting, MCP configuration, and middleware configuration. Opaque L7 errors identify the protocol-configuration or policy-validation stage; endpoint conflicts report ambiguous selectors. YAML errors retain a fixed parser category and numeric line and column when available. File I/O, Rego loading, and internal policy-data errors use fixed messages.
+
+A candidate rejected during validation does not replace the active engine or advance its generation. The supervisor separately applies `policy_validation_failure_mode` and may publish a quarantine generation as described below. The diagnostic bounds cover returned OPA load errors; accepted-policy warnings, runtime request diagnostics, and gateway-authored policy parser messages have separate reporting contracts.
+
 ## Live Updates
 
 The gateway stores sandbox-authored policy revisions separately from derived