fix: prevent fmt.Sprintf from mangling % characters in plan output

[m-agahi]

🧠 Ai UsageDetails (if applicable):

This PR was written with the assistance of Claude Code (code fix, tests, and PR description generated by Claude Code, reviewed manually).

---

Problem

GetTerraformOutputAsCollapsibleComment and AsCollapsibleComment embed the comment and summary strings directly into the format string passed to fmt.Sprintf. Any % characters in the content get interpreted as format verbs, producing %!(MISSING) / %!(BADWIDTH) in the output.

Real-world examples that trigger this:

• MySQL wildcard host 10.% in mysql_user / mysql_grant resource addresses
• override_special = "~!#%^&*()..." in random_password resources

Before (broken):

return fmt.Sprintf(`<details %v><summary>` + summary + `</summary>\n...\n` + comment + `\n...`, openTag)

After (fixed):

return fmt.Sprintf("<details %s><summary>%s</summary>\n\n```terraform\n%s\n```\n</details>", openTag, summary, comment)

Changes

• GetTerraformOutputAsCollapsibleComment: pass summary and comment as %s arguments instead of interpolating into the format string
• AsCollapsibleComment: same fix
• Added regression tests for both functions covering % in comments, % in summaries, and open/closed tag behavior

GetTerraformOutputAsComment and AsComment use string concatenation (not fmt.Sprintf) so they are unaffected.

Test plan

• go test -v ./libs/comment_utils/reporting/ — all 7 tests pass
• Verified tests fail on the unfixed code with %!(MISSING) errors, confirming they catch the bug