build(ssh): bound linker path diagnostic

Co-authored-by: Orca <help@stably.ai>

config/scripts/ssh-relay-runtime-toolchain.mjs

@@ -200,7 +200,8 @@ export function sshRelayRuntimeWindowsMsvcToolsetVersion(path) {
     segments[msvcIndex + 2]?.toLowerCase() !== 'bin' ||
     segments.at(-1)?.toLowerCase() !== 'link.exe'
   ) {
-    throw new Error('Resolved Windows linker is not in a bounded MSVC toolset path')
+    const diagnostic = segments.slice(-12).join(win32.sep).slice(-512) || '<empty>'
+    throw new Error(`Resolved Windows linker is not in a bounded MSVC toolset path: ${diagnostic}`)
   }
   // Why: hosted link.exe has no version resource; its resolved toolset path plus byte hash is exact.
   return `MSVC ${version}`

config/scripts/ssh-relay-runtime-toolchain.test.mjs

@@ -58,6 +58,13 @@ describe('SSH relay runtime build provenance', () => {
     ).toThrow(/^Runtime build tool did not report a bounded version line: unexpected x{490}/)
   })
 
+  it('bounds rejected Windows linker path diagnostics', () => {
+    const path = String.raw`C:\${'unexpected\\'.repeat(100)}link.exe`
+    expect(() => sshRelayRuntimeWindowsMsvcToolsetVersion(path)).toThrow(
+      /^Resolved Windows linker is not in a bounded MSVC toolset path: .{1,512}$/
+    )
+  })
+
   it('pins GitHub builder identity to the exact source commit', () => {
     expect(
       sshRelayRuntimeBuilderIdentity({