#338 Step key parsing in execution_service uses naive split(":") and silently truncates colon-containing step names

Summary

In src/domain/workflows/execution_service.ts, the workflow-scope report flow builds a per-step lookup map keyed as ${event.jobId}:${event.stepId}, then extracts the step name via key.split(":")[1] ?? "". If a step name contains a colon (e.g. docker:build), only the portion between the first and second colon is captured; anything after is silently lost.

This was noted in the adversarial review of swamp-club#337 (PR systeminit/swamp#1372) but kept pre-existing pattern for blast-radius reasons. In practice step names are simple identifiers today, so there is no observable user impact — filing for defensive cleanup.

Where

src/domain/workflows/execution_service.ts (the runWorkflowReports helper, around the key.split(":")[1] site introduced/touched by swamp-club#337). The same pattern existed in the libswamp post-run reporting code before #337 moved the logic.

Suggested fix

Split on the first colon only:

const colonIdx = key.indexOf(":");
const jobName = colonIdx >= 0 ? key.slice(0, colonIdx) : key;
const stepName = colonIdx >= 0 ? key.slice(colonIdx + 1) : "";

Or change the key encoding to a tuple/object so step names with colons are not subject to string parsing at all.

Impact

None today — step names are validated as simple identifiers. Filed as a defensive-coding follow-up so the assumption is removed before it can break a future step-naming convention (e.g. namespaced steps, tool identifiers, etc.).

Origin

Follow-on from swamp-club#337 / systeminit/swamp#1372 adversarial review.