Anything but POSIX portable filename set with a conservative length restriction is dangerous

I think you are right here and restricting the username to a limited subset of bytes that existing tools don't have any trouble interpreting and displaying makes sense, but the GECOS field definitely should be extended to support full UTF-8 encoded names as a courtesy and to be friendly to actual humans and their real written names they want to use. Having machine-readable username/uid/gid(s) distinct from a human display name makes sense and changes the requirements quite a bit where having two different encodings for "é" or "🧪420" isn't really a problem that needs to be solved.