fix(diag): redact embedder-chosen segment names from crash reports

A corruption report may be shipped to crash telemetry, and the segment
`name` carried by `CorruptionDetail::SegmentMissing` is application
data the embedder supplied (a tenant id, a user's collection name),
not something diagnosis needs — the `segment_id` already identifies
the file. Render it as a redacted byte length instead of the raw
string.

Author: farhan-syah

src/diag.rs

@@ -188,8 +188,12 @@ mod imp {
         /// discipline `PageReadVerifyFailure` already uses, so one bug landed
         /// once still collapses to one report under fuzzing.
         grouping_key: String,
-        /// Full `Debug` rendering of the detail, for a report that is
-        /// diagnosable on its own.
+        /// `Debug` rendering of the detail, for a report that is diagnosable
+        /// on its own — with embedder-chosen text redacted. A report may be
+        /// shipped to crash telemetry, and a segment name is application data
+        /// (a tenant id, a user's collection name) that diagnosis never needs:
+        /// the identity that locates the file is the `segment_id`, which is
+        /// kept. See [`redacted_debug`].
         detail_debug: String,
     }
 
@@ -205,6 +209,31 @@ mod imp {
         }
     }
 
+    /// Render a [`CorruptionDetail`] for a report, replacing any
+    /// embedder-chosen string with its length.
+    ///
+    /// Every field in the taxonomy is either a `&'static str` this crate
+    /// wrote, a numeric id, or a raw identity — none of which is application
+    /// data — except the segment `name` carried by
+    /// [`CorruptionDetail::SegmentMissing`], which is whatever the embedder
+    /// passed to `link_segment`. That one is replaced here rather than
+    /// suppressed at the call site, so a future variant that adds a name gets
+    /// the same treatment by extending this one function.
+    fn redacted_debug(detail: &CorruptionDetail) -> String {
+        match detail {
+            CorruptionDetail::SegmentMissing {
+                realm_id,
+                name,
+                segment_id,
+            } => format!(
+                "SegmentMissing {{ realm_id: {realm_id:?}, name: <redacted, {} bytes>, \
+                 segment_id: {segment_id:?} }}",
+                name.len()
+            ),
+            other => format!("{other:?}"),
+        }
+    }
+
     /// Classify a [`CorruptionDetail`] into a stable domain kind and a
     /// grouping key that names the structural fields of the failure but never
     /// the instance-specific ones (page ids, segment ids), so many
@@ -332,7 +361,7 @@ mod imp {
         let ctx = CorruptionConstructed {
             kind,
             grouping_key,
-            detail_debug: format!("{detail:?}"),
+            detail_debug: redacted_debug(detail),
         };
         let _ = faultbox::Capture::new(
             faultbox::EventKind::Corruption,