feat(compilers/openapi): bound input size, honour cancellation

[OmarAlJarrah]

Summary

The compiler already carries two dozen named caps, and the ones a pathological
input can reach do fire: schema nesting past 256 and YAML alias amplification
both produce a coded, provenanced diagnostic and exit 1. What none of them
bounds is cardinality or aggregate size. A legal OpenAPI 3.1 document whose
one component declares a 1,000,000-member enum turned 10 MB of source into
2.6 GB of peak RSS and 318 MB of IR JSON, exiting 0 with an empty stderr — the
failure mode on that axis was OOM-or-succeed, never a diagnostic.

This adds budgets for that axis, as options rather than constants, because what
counts as too large depends on the machine doing the compiling:

• openapi.Options.Limits.MaxSourceBytes (default 64 MiB), checked before the
  source is parsed — the only bound that can be taken before anything about the
  document is known, and what bounds the parse itself.
• Limits.MaxSourceNodes (default 2,097,152), checked on the parsed tree after
  any overlay is applied, before the typed model is built from it. Node count is
  what the phases after the parse cost.
• Limits.MaxEnumMembers (default 65,536). An enum is the one construct whose
  IR cost per source node is disproportionate — a canonical word sequence per
  member, or a hoisted literal type and a union variant per member — which is
  why the node budget does not cover it.

Each default is calibrated against measured documents rather than chosen round;
the constants carry the numbers and the margins. The largest public description
measured (GitHub's REST API, 12.9 MB, 471,735 nodes, largest enum 53 members)
sits 4.4x inside the tightest of them. Zero takes the default in every field and
a negative value turns the budget off, so a caller with the memory for a huge
input keeps the old behaviour. Crossing a budget is a spec problem, so it is an
openapi/budget-exceeded error diagnostic, not a Go error; the two load-phase
budgets refuse the document, the enum budget degrades that one node to the top
type and lets the rest of the document lower.

Time was not a bound either. ctx was threaded through Compile and never
consulted anywhere in the compiler, so a caller could not stop a runaway compile
with a deadline. The two walks that do work proportional to the document — the
component-schema loop and the path/webhook loops — now check ctx.Err() between
items, and run refuses at the phase boundary after each rather than assembling
a document from a half-filled registry. Cancellation reaches the caller as the
wrapped context.Canceled/DeadlineExceeded, since nothing about the document
is wrong; the diagnostics gathered before the stop are still returned.

Measured on the reproduction above: exit 0 with no diagnostics and 2.59 GB peak
RSS becomes exit 1 with one diagnostic naming the enum, its pointer, the count
and the budget, at 896 MB and 3.5 s. GitHub's spec compiles to byte-identical IR
with no budget diagnostic.

Test plan

• Each budget has a boundary table asserting the limit is what is allowed: at
  the limit the document lowers whole, one past it is refused. Bytes and enum
  members are pinned through the public Compile; the node budget is pinned
  exactly in the load package, where the count the loader takes is visible.
• A large-but-legal case compiles a 3,000-member enum under the defaults and
  asserts every member reaches the IR and no budget diagnostic is raised, so the
  budgets cannot pass by refusing anything big.
• A case with every budget set negative asserts the pre-budget lowering, and a
  table over Limits.withDefaults pins which spellings mean default, set and
  off.
• Cancellation is asserted by the work not done — a cancelled component walk
  interns nothing, a cancelled service walk produces no group — since the phase
  boundary above would report the same error with neither loop checking. The
  boundary checks themselves are driven by a context that reports itself live for
  a chosen number of calls, which is what places the cancellation at a specific
  boundary deterministically instead of racing the walk against a timer.
• Every cap and every ctx.Err() check was reverted in turn with the tests left
  in place; each went red, and all six were restored before the gate ran.
• Full gate green, coverage at exactly 100%. No fixture was committed: the large
  specs are generated in the tests, and no golden changed.

Closes#75