repair: minor follow-ups from #2614 review

Non-blocking items from the independent review of #2614 (blockers B1/M1 + n1 fixed in the PR).

- **m1:** `revalidate`'s AC-10 net keys on ConfigPath but the rename-class warning finding uses the bare field name while the applied fix uses the full pointer — they can't match, so a rename that failed to clear its finding wouldn't be caught. Also, AC-10 says 'introduces no new finding' but revalidate only checks applied paths cleared. Fix the convention mismatch or document the narrower guarantee.
- **m2:** `repair f.yaml --apply --yes` with only a restart-class fix returns `no_fixes_available` (confusing after read mode showed a fix). Distinguish 'nothing safe to auto-apply; N need explicit --fix' from genuinely clean.
- **m3:** the read-mode `Before` diff renders the YAML anchor name for an aliased value (`st -> running`) instead of the resolved value. Apply is correct; preview is misleading.
- **n2:** `/description` truncation cuts on a byte boundary and can split a multibyte rune; truncate on a rune boundary (utf8-aware).
- **n3:** `codes.go:23` comment says 'All five map to exit 2' — the feature registers six codes.

Source: fresh-context review of #2614.

Start by tracing the repair command's read/apply paths and revalidate's AC-10 handling, then inspect codes.go:23. Reproduce the restart-only --apply --yes case and the aliased YAML preview; done means the five listed follow-ups are corrected or their narrower guarantee is documented, with UTF-8-safe truncation and accurate exit-code documentation.

Written by the indexing model from the issue text.