Function sanitize_changelog_subject 

pub fn sanitize_changelog_subject(subject: &str) -> String

Neutralize and bound a commit-derived changelog bullet before it reaches CHANGELOG.md or a tracing line (D-12, ASVS V7, T-26-05). Commit subjects are contributor-authored text — the same attacker-influenced class T-17-13/T-25-52 already redact — so every char::is_control character is mapped to a single space, then, if the result exceeds CHANGELOG_SUBJECT_MAX_CHARS characters, it is truncated so the returned string is exactly CHANGELOG_SUBJECT_MAX_CHARS characters including the trailing … [truncated] marker. Mirrors render_gate_context’s properties (pipeline_outcomes.rs:323) — a sibling, not a shared function, since that one is pub(crate) inside devflow-cli and not importable from devflow-core.