Fix malformed chunk cache directory handling

[efe-arv]

Summary

• skip malformed chunk-cache key directories instead of panicking during cache initialization
• require each encoded key directory to live under its exact two-byte prefix directory
• reject decoded key names shorter than a MerkleHash before slicing
• add regression coverage for short encoded names, short decoded keys, and mismatched prefixes

Why

DiskCache::initialize_state scanned cache directories before fully validating their names. A stray directory such as <cache>/ab/x caused an out-of-bounds panic while slicing the first two bytes. A matching Base64 name such as <cache>/AA/AA passed that check but decoded to fewer than 32 bytes and panicked while extracting the hash. In debug builds, a valid-looking key under the wrong prefix also triggered an assertion; in release builds it could be admitted under an inconsistent path.

Cache initialization already skips other malformed entries, so this keeps that fail-soft behavior consistent without changing valid cache entries.

Verification

• RED: test_initialize_ignores_short_key_directory_name reproduced range end index 2 out of range for slice of length 1
• RED: test_initialize_ignores_key_directory_under_wrong_prefix reproduced the prefix assertion failure
• focused regressions: 3 passed
• cargo +1.95.0 test -p xet-client --lib: 209 passed, 4 ignored
• cargo +1.95.0 test --no-fail-fast --features "strict simulation internal-tools git-xet-for-integration-test": passed
• cargo +1.95.0 clippy -r -p xet-client --lib -- -D warnings: passed
• rustup run 1.95.0 rustfmt --edition 2024 --check xet_client/src/chunk_cache/disk.rs: passed
• git diff --check: passed

Scope

One Rust source file; no dependency or public API changes.

---

Note

Low Risk
Changes only affect scanning of existing cache directories at init; valid entries behave the same and malformed paths are ignored rather than crashing.

Overview
Disk cache startup no longer panics or asserts when the on-disk layout contains stray or invalid key directories. During initialize_state, encoded key folder names are validated before parsing: names shorter than the two-byte prefix are skipped, and the name’s prefix must match the parent prefix directory (case-insensitive)—replacing a debug-only assertion that could fail in debug builds or admit inconsistent paths in release.

Key decoding in try_parse_key now checks that Base64-decoded data is at least MerkleHash-sized before slicing, returning a parse error instead of panicking on truncated payloads (e.g. AA/AA).

Three unit tests lock in fail-soft behavior for short directory names, undersized decoded keys, and keys stored under the wrong prefix folder.

^{Reviewed by Cursor Bugbot for commit 9a5da45. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit cac7a48. Configure here.}