[Repo Assist] refactor(config): extract shared non-empty string slice validator (#12158)

🤖 *This PR was created by Repo Assist, an automated AI assistant.*

## Summary
Partial fix for duplicate-code finding #12143 (recommendation 1):
`validateAgentIDs` and `validateTrustedBots` in
`internal/config/validation_gateway.go` independently re-implemented the
same "non-empty array of non-empty strings" validation logic with
slightly different signatures.

## Change
- Added `validateNonEmptyStringSlice(values []string, defined bool,
fieldName, specSuffix string) error` to
`internal/config/validation_rules.go` as the single source of truth for
this rule.
- Rewired `validateAgentIDs` and `validateTrustedBots` to delegate to
the new helper, preserving their exact existing error-message wording
(verified against `validation_gateway_coverage_test.go` and
`config_stdin_test.go`).

## Scope note
I intentionally left `ValidateStringArrayField` in
`internal/config/guard_policy_validation.go` (recommendation 2 in
#12143) unchanged. It operates on `[]interface{}` rather than `[]string`
and its error messages ("invalid %s value: ...") are pinned by an
extensive existing test suite
(`guard_policy_string_validation_test.go`). Bridging it onto the same
helper would require changing those user-facing error strings, which
felt out of scope for a "clearly beneficial, low-risk" improvement —
happy to revisit if maintainers want that follow-up too.

## Test Status
- `go build ./...` — pass
- `go vet ./...` — pass
- `gofmt -l .` — no diffs
- `go test ./...` (all packages, unit) — pass
- `go test ./test/integration/...` (binary built via `make build`) —
pass (46.8s)
- golangci-lint not available in this sandbox; relied on `gofmt`/`go
vet` as a fallback.

Closes #12143

> [!WARNING]
> <details>
> <summary>Firewall blocked 1 domain</summary>
>
> The following domain was blocked by the firewall during workflow
execution:
>
> - `api.github.com`
>
> [!TIP]
> `api.github.com` is blocked because GitHub API access uses the
built-in GitHub tools by default. Instead of adding `api.github.com` to
`network.allowed`, use `tools.github.mode: gh-proxy` for direct
pre-authenticated GitHub CLI access without requiring network access to
`api.github.com`:
>
> ```yaml
> tools:
>   github:
>     mode: gh-proxy
> ```
>
> See [GitHub
Tools](https://github.github.com/gh-aw/reference/github-tools/) for more
information on `gh-proxy` mode.
>
> To allow these domains, add them to the `network.allowed` list in your
workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "api.github.com"
> ```
>
> See [Network
Configuration](https://github.github.com/gh-aw/reference/network/) for
more information.
>
> </details>

> Generated by [Repo
Assist](https://github.com/github/gh-aw-mcpg/actions/runs/33312260725) ·
copilot · auto · 182.5 AIC · ⊞ 18.9K ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+repo-assist%22&type=pullrequests)
> <sub>Comment <em>/repo-assist</em> to run again</sub>
>
<details>
<summary><sub>Add this agentic workflow to your repo</sub></summary>

To install this agentic workflow, run

```
gh aw add githubnext/agentics@851905c
```
</details>


<!-- gh-aw-agentic-workflow: Repo Assist, engine: copilot, model: auto,
id: 33312260725, workflow_id: repo-assist, run:
https://github.com/github/gh-aw-mcpg/actions/runs/33312260725 -->

<!-- gh-aw-workflow-id: repo-assist -->
<!-- gh-aw-workflow-call-id: github/gh-aw-mcpg/repo-assist -->

Author: lpcox

internal/config/validation_gateway.go

@@ -104,18 +104,7 @@ func validateGatewayConfig(gateway *StdinGatewayConfig) error {
 }
 
 func validateAgentIDs(agentIDs []string, defined bool, fieldName string) error {
-	if !defined {
-		return nil
-	}
-	if len(agentIDs) == 0 {
-		return fmt.Errorf("%s must be a non-empty array when present", fieldName)
-	}
-	for i, agentID := range agentIDs {
-		if strings.TrimSpace(agentID) == "" {
-			return fmt.Errorf("%s[%d] must be a non-empty string", fieldName, i)
-		}
-	}
-	return nil
+	return validateNonEmptyStringSlice(agentIDs, defined, fieldName, "")
 }
 
 func validateGatewayPayloadSizeThreshold(value int, fieldName, jsonPath string) error {
@@ -136,18 +125,7 @@ func validateContainerRuntimeCommandNotBlank(command, fieldName, jsonPath string
 // validateTrustedBots checks that the trusted_bots/trustedBots list conforms to spec §4.1.3.4:
 // when present, it must be a non-empty array of non-empty strings.
 func validateTrustedBots(bots []string) error {
-	if bots == nil {
-		return nil
-	}
-	if len(bots) == 0 {
-		return fmt.Errorf("trusted_bots must be a non-empty array when present (spec §4.1.3.4)")
-	}
-	for i, bot := range bots {
-		if strings.TrimSpace(bot) == "" {
-			return fmt.Errorf("trusted_bots[%d] must be a non-empty string", i)
-		}
-	}
-	return nil
+	return validateNonEmptyStringSlice(bots, bots != nil, "trusted_bots", " (spec §4.1.3.4)")
 }
 
 // validateTOMLStdioContainerization validates that TOML stdio servers use the selected container runtime command.

internal/config/validation_rules.go

@@ -32,6 +32,26 @@ func PortRange(port int, jsonPath string) *ValidationError {
 	return nil
 }
 
+// validateNonEmptyStringSlice validates that, when defined is true, values is a non-empty
+// slice containing only non-empty (non-whitespace) strings. When defined is false, the field
+// is treated as absent and validation passes trivially. fieldName is used for both the
+// top-level error and per-element errors; specSuffix (e.g. " (spec §4.1.3.4)") is appended
+// verbatim after "when present" in the top-level error, or may be empty.
+func validateNonEmptyStringSlice(values []string, defined bool, fieldName, specSuffix string) error {
+	if !defined {
+		return nil
+	}
+	if len(values) == 0 {
+		return fmt.Errorf("%s must be a non-empty array when present%s", fieldName, specSuffix)
+	}
+	for i, v := range values {
+		if strings.TrimSpace(v) == "" {
+			return fmt.Errorf("%s[%d] must be a non-empty string", fieldName, i)
+		}
+	}
+	return nil
+}
+
 func validatePositiveIntegerRule(value int, fieldName, jsonPath, logLabel, failureLabel, suggestion string) *ValidationError {
 	logValidation.Printf("Validating %s: field=%s, value=%d, jsonPath=%s", logLabel, fieldName, value, jsonPath)
 	if value < 1 {