git: reject malformed conflict labels

[ShiroKSH]

Summary

• Reject malformed jj:conflict-labels commit headers instead of panicking while importing or reading Git commits.
• Verify that conflict labels describe the same number of sides as the root tree.

Root cause

The header was decoded as UTF-8 and passed directly to Merge, which assumes an odd number of terms. A malformed Git commit could violate those assumptions and abort jj.

Tests

• cargo test -p jj-lib --test runner test_invalid_conflict_labels_header -- --exact
• cargo +stable clippy -p jj-lib --test runner -- -D warnings
• cargo +nightly fmt --all -- --check

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[PhilipMetzger]

Can you please put the PR description into the commit description to adhere to the project commit guidelines. Thanks.

[ShiroKSH]

Updated in f9d7707. The commit description now contains the PR summary, root cause, and local checks.

[martinvonz]

Thanks.

From commit description:

• cargo test -p jj-lib --test runner test_invalid_conflict_labels_header -- --exact
• cargo +stable clippy -p jj-lib --test runner -- -D warnings
• cargo +nightly fmt --all -- --check

FYI, we run all that on CI (and all tests, of course), so there's no need to include the commit description. Any manual tests you ran could be useful, however, but there's no expectations that you run manual tests.

Out of curiosity, did you run into that crash in practice? If so, do you know how the bad header ended up in the commit?

[ShiroKSH]

Addressed in 0015549.

• lib/src/git_backend.rs: removed the root-tree/label-count comparison; malformed labels are rejected before constructing Merge.
• lib/tests/test_git_backend.rs: added comments identifying malformed-input and read-path coverage.
• Removed automated CI commands from the commit description.

This is defensive hardening. I do not have a concrete crash report or provenance for a malformed header to add.