chore: refine security-guard diff truncation handling

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/9a210269-8ac9-41e3-919f-856a1265a617

Author: Copilot

.github/workflows/security-guard.lock.yml

@@ -32,16 +32,17 @@ steps:
     if: github.event.pull_request.number
     run: |
       DELIM="GHAW_PR_FILES_$(date +%s)"
+      DIFF_LIMIT=5000
       DIFF_TMP="$(mktemp)"
       {
         echo "PR_FILES<<${DELIM}"
         gh api "repos/${GH_REPO}/pulls/${PR_NUMBER}/files" \
           --paginate --jq '.[] | "### " + .filename + " (+" + (.additions|tostring) + "/-" + (.deletions|tostring) + ")\n" + (.patch // "") + "\n"' \
           > "$DIFF_TMP" || true
         DIFF_SIZE="$(wc -c < "$DIFF_TMP" | tr -d ' ')"
-        head -c 5000 "$DIFF_TMP" || true
-        if [ "$DIFF_SIZE" -gt 5000 ]; then
-          echo -e "\n[DIFF TRUNCATED at 5000 chars — use get_file_contents for full context]"
+        head -c "$DIFF_LIMIT" "$DIFF_TMP" || true
+        if [ "$DIFF_SIZE" -gt "$DIFF_LIMIT" ]; then
+          echo -e "\n[DIFF TRUNCATED at ${DIFF_LIMIT} bytes — use get_file_contents for full context]"
         fi
         echo ""
         echo "${DELIM}"