test: screen selector bounds and BLE global script handler encoding

[cursor]

Description

Adds regression tests around recent security-sensitive definition loading and BLE notify handling. Includes a tiny @visibleForTesting helper so the JSON-encoding contract used by ScreenController.runGlobalScriptHandler stays explicitly covered.

Related Issue

N/A (automation coverage pass).

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Tests / coverage (non-functional test additions and minimal testability hook)

What Has Changed

• modules/ensemble/test/remote_definition_security_test.dart: assert isSafeRemoteScreenSelector rejects ASCII DEL (\u007f) and strings longer than 256 characters (bounds used by local bundled and remote screen resolution).
• modules/ensemble_bluetooth/lib/ensemble_bluetooth.dart: introduce encodeBleUtf8PayloadForScriptHandler (same jsonEncode behavior as before) so unit tests pin the “safe string literal argument” property for BLE payloads passed into functionName($inputs) construction in ScreenController.
• modules/ensemble_bluetooth/test/ensemble_bluetooth_test.dart: replace placeholder test with deterministic encoding cases (quotes, newlines, adversarial substrings).

Risky behavior now covered

• Screen selectors: the shared guard used for both remote YAML URLs and bundled rootBundle.loadString('.../screens/<screen>.yaml') paths must reject oversized and DEL-containing values, not only obvious ../ and slash cases. A regression in the length or control-character checks could re-open asset or CDN path abuse.
• BLE notify → global script: characteristic text is interpolated into a generated library.function(<inputs>) call. JSON-encoding as a single string literal prevents delimiter injection; tests now lock that encoding step to the helper used in production.

How to Test

1. From repo root: melos bootstrap (if dependencies are not linked).
2. cd modules/ensemble && flutter test test/remote_definition_security_test.dart
3. cd modules/ensemble_bluetooth && flutter test

Environment note: The automation sandbox did not have the Flutter SDK on PATH, so flutter test was not executed here. Please run the commands above in a normal dev/CI environment; the added tests are pure Dart (jsonEncode / jsonDecode and string predicates) and should not be environment-dependent.

Screenshots / Videos

N/A

Checklist

• I have run flutter analyze and addressed any new warnings
• I have run flutter test and all tests pass
• I have tested my changes on the relevant platform(s)
• I have updated documentation if needed
• My changes do not introduce new warnings or errors (not verified in sandbox; analyzer/test run recommended on CI)

Why these tests materially reduce regression risk

They target high blast-radius security invariants that are easy to break with a small refactor: (1) selector validation is centralized and reused; missing a boundary case reintroduces traversal or unexpected IO. (2) BLE payloads are attacker-controlled once a device is paired; losing jsonEncode silently restores script injection into the global handler bridge.