Package stringutil holds small string helpers shared across the internal
packages. Depends on nothing but the standard library, so any of them can
import it.
Truncate shortens s to at most limit bytes, marking the cut with an ellipsis.
The cut lands on a rune boundary, so the result stays valid UTF-8 — callers
truncate HTTP response bodies for error messages, which are usually UTF-8.