docs(zenoh): document the zenoh#2836 exposure and fix two nits

[lxsaah]

Description

A docs-only follow-up to the verification of #316. It changes no code.

The zenoh#2836 exposure. docs/upstream/zenoh-2836-…md says the connector is not affected, because ZenohGrammar never calls intersects. But zenoh's Session does: it matches every delivered sample against each subscriber's key expression with intersects (subscriber_callbacks in zenoh/src/api/session.rs, 1.10.1). So an inbound zenoh:// link whose filter has a ** with more chunks after it is exposed. zenoh://site/{path..}/state is one example: it subscribes to site/**/state. One sample with a long matching key aborts the process.

Reproduced on zenoh 1.10.1, release build, with three processes:

• A client subscribed to a/**/b through a router, and another client did one put on a matching key: 32,000 chunks, 64,001 bytes, inside the wire format's limit.
• The subscriber died with thread 'rx-0' has overflowed its stack and fatal runtime error: stack overflow, aborting. The router survived.
• Peer to peer, **/b and a/*/**/b aborted the same way.
• a/** received the same long key without problems, because intersects returns at once when the ** is last.

Changes:

• docs/upstream/zenoh-2836-keyexpr-intersects-stack-overflow.md: replaces "so the connector is not affected" with the session path and the measurements. It also sketches a possible guard: declare such a filter only up to its first **, then match the full filter in the callback.
• docs/design/053-zenoh-connector.md §4.3: a new sub-bullet on the inbound side.
• aimdb-zenoh-connector/README.md, Limits section: a new bullet.

Nits:

• Makefile: ros2-interop moves under its own ## Interop header. It had landed between readme-check and that target's comment.
• docs/aimdb-usage-guide.md: the Zenoh example now registers both connectors (AimDbBuilder::new().runtime(runtime).with_connector(zenoh).with_connector(ros2)). Before, it created them but never passed them to a builder.

Reproduction (zenoh 1.10.1, features transport_tcp)

// role router | sub <filter> | pub <chunks> <suffix>: each one a separate process
let mut c = zenoh::Config::default();
c.insert_json5("mode", if role == "router" { r#""router""# } else { r#""client""# })?;
c.insert_json5("scouting/multicast/enabled", "false")?;
// router: listen/endpoints = ["tcp/127.0.0.1:47448"]; others: connect/endpoints = the same
let s = zenoh::open(c).await?;
// sub: s.declare_subscriber("a/**/b").allowed_origin(Locality::Remote).callback(|_| {}).await?;
// pub: s.put(vec["a"; 32_000].join("/") + "/b", "x").await?;

router, then sub 'a/**/b', then pub 32000 /b. The subscriber aborts and the router keeps running.

Related Issue

• Follow-up to Zenoh connector and ROS 2 topics through rmw_zenoh (design 053, native backend) #316. There's no issue for this.

Checklist

• I have read the CONTRIBUTING.md document.
• My code follows the project's coding standards: n/a, this is docs only.
• I have added tests to cover my changes: n/a, there are no code changes.
• All new and existing tests passed (make check): not run, since this is docs plus a moved Makefile block. make readme-check passes and make -n ros2-interop parses. CI's pull_request trigger doesn't cover PRs into this branch.
• I have updated the documentation accordingly.

🤖 Generated with Claude Code

https://claude.ai/code/session_019466ean3DmpcQPdR1DApoT

---

Generated by Claude Code