Quoted paths in report.md show non-ASCII characters as \u escapes #1790

Summary

When report.md quotes a file path, every non-ASCII character in that path shows as a \uXXXX escape. The report quotes a path when it has a comma, unusual whitespace, or a control character. Thus a path such as docs/Résumé, final.md shows as "docs/R\u00e9sum\u00e9, final.md" in "Included paths", "Excluded paths", the "Affected lines" cell, and code-evidence locations.

Version / source checked

• CLI/SDK 0.5.0 source, current main at 06201edfa54a83fdfc3a9d0e28bfb019ce30b4c0, checked on 2026-10-20
• Linux x64, Python 3.14.4

Reproduction

Project a canonical scan that has a finding location and an include path of docs/Résumé, final.md (a fictional path) with report_projection.build_report_markdown:

import report_projection as p

manifest = {"scan": {"target": {"displayName": "example/repo"}, "scope": {"includePaths": [], "excludePaths": []}}}
findings = {"findings": [{
    "occurrenceId": "occ_1", "title": "Example finding", "summary": "Example.",
    "severity": {"level": "high"}, "confidence": {"level": "high", "rationale": "Direct trace."},
    "taxonomy": {"category": "example", "cwe": ["CWE-20"]}, "remediation": "Example.",
    "locations": [{"path": "docs/Résumé, final.md", "startLine": 3}],
}]}
coverage = {"mode": "repository", "inventoryStrategy": "repository",
            "includePaths": ["docs/Résumé, final.md"], "excludePaths": []}
print(p.build_report_markdown(manifest, findings, coverage))

Observed:

- Included paths: `"docs/R\u00e9sum\u00e9, final.md"`
| Affected lines | `"docs/R\u00e9sum\u00e9, final.md"`:3 |

Expected:

- Included paths: `"docs/Résumé, final.md"`
| Affected lines | `"docs/Résumé, final.md"`:3 |

A path that does not need quotes, such as docs/Résumé.md, already shows its characters correctly.

Relevant code

• _path_label calls json.dumps(value). The default ensure_ascii=True escapes all non-ASCII characters, not only the control characters that the quotes are there to show.