fix(pixel-settings): convert decode and protocol failures to unsafe-settings-source

[vaibhavsrv]

Why this matters

In ods/bin/pixel_settings/coordinator.py, _read(path, uid, maximum) safely reads settings documents, root recovery journals, and provider configurations while verifying file descriptor metadata and permissions against the host owner UID. If file attributes change or file size limits are exceeded, _read raises AccessError("unsafe-settings-source") or AccessError("settings-source-changed").

However, _read directly performed raw.decode("utf-8") and decode_frame(...) without exception handling. When encountering non-UTF-8 bytes or malformed framing (such as unexpected EOF, syntax errors, or duplicate JSON keys), raw.decode("utf-8") raised unhandled UnicodeDecodeError and decode_frame raised ProtocolError ("owner-protocol-failed"). These unhandled exceptions escaped the privileged access coordinator instead of being converted into AccessError("unsafe-settings-source"), failing the coordinator's security guarantee that corrupted or unparseable source files are classified as unsafe sources.

This surgical fix wraps raw.decode("utf-8") and decode_frame in a try...except (UnicodeDecodeError, ProtocolError) block that raises AccessError("unsafe-settings-source") from None.

Validation

• Baseline reproduction: Executed c._read on a file containing non-UTF-8 bytes (b"\xff\xfe\x00\x00") and unformatted JSON text on unpatched coordinator.py. Baseline failed by leaking unhandled UnicodeDecodeError and ProtocolError.
• Post-fix behavior: Both invalid UTF-8 and malformed frames raise AccessError("unsafe-settings-source").
• Telemetry: pixel-settings coordinator suites: regression tests passed. New-test syntax and diff checks pass; new regressions wired into test suite.

Overlap check

• fix(pixel-settings): reject active token limits exceeding provider capacity #5696 (fix(pixel-settings): reject active token limits exceeding provider capacity): Bounds runtime capability values in contract.py; zero overlap with coordinator file I/O in coordinator.py.
• fix(dashboard-api): tolerate evicted or missing attempts during pixel chat cancel #5695 (fix(dashboard-api): tolerate evicted or missing attempts during pixel chat cancel): Touches dashboard API chat result store lifecycle; zero overlap with settings coordinator.
• fix(pixel-gateway): answer 401 for non-ASCII Authorization headers #5693 (fix(pixel-gateway): answer 401 for non-ASCII Authorization headers): Restricts header bytes validation in provider gateway; zero overlap with settings coordinator error handling.
• fix(pixel-settings): reject active context exceeding provider limit in capabilities #5616 (fix(pixel-settings): validate runtime capability bounds): Touched capability schema; no overlap with low-level coordinator deserialization.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This converts raw decoding and protocol exceptions into the coordinator's standard AccessError hierarchy. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #5696 at 132e51511 without conflicts. Production and test diffs passed together; coordinator and contract checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.