fix(executor): bound Rhai→JSON materialization to prevent anonymous OOM

The per-element Rhai sandbox caps (max_string_size 64 KiB, max_array_size /
max_map_size 10 000) do NOT bound the *materialized* size: Rhai shares strings
and arrays by Rc, so a 10 000-element array of one aliased 64 KiB string is
cheap to build (~10 000 ops, far under the 1 M op budget) yet dealiases to
~640 MiB of distinct JSON. Every Dynamic→JSON conversion deep-copies the
aliases; the HTTP response body path had NO size cap at all, and the KV/docs
value caps run only AFTER full materialization — so a handful of anonymous
requests could OOM the node (32 concurrent × ~640 MiB ≈ 20 GiB) on the stated
consumer-hardware target.

Add a byte-budgeted materializer that bails the moment the budget is exceeded,
so the transient allocation is bounded regardless of aliasing:
- bridge.rs: `dynamic_to_json_capped(value, max) -> Result<Json, JsonSizeError>`
  (charges a running budget) + `MAX_JSON_MATERIALIZE_BYTES` (16 MiB hard rail,
  far above the 256 KiB business caps). `dynamic_to_json` stays infallible for
  best-effort paths (logging) but is now internally bounded — it collapses an
  over-limit value to a marker string instead of OOMing.
- Route every user-value boundary through the fail-closed capped form: KV
  set/set_if (+ the CAS `expected`), docs create/update/find, secrets set,
  http request body, workflow input, `json::stringify`, and the HTTP RESPONSE
  body (previously the one fully-uncapped exit → now a 500). `invoke` args and
  the pubsub/queue message materializers get the same byte budget in place.
- `impl From<JsonSizeError> for Box<EvalAltResult>` so SDK sites protect
  themselves with a bare `?`.

Pinned by bridge unit tests: an aliased 10 000×64 KiB array errors on the
budget rather than materializing, and the infallible wrapper yields a marker
instead of OOMing. Workspace 914 + journeys 157/157 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/invoke.rs

@@ -42,7 +42,7 @@ use tokio::runtime::Handle as TokioHandle;
 
 use crate::engine::Engine;
 use crate::sandbox::Limits;
-use crate::sdk::bridge::json_to_dynamic;
+use crate::sdk::bridge::{json_to_dynamic, MAX_JSON_MATERIALIZE_BYTES};
 use crate::types::{ExecRequest, InvocationType};
 
 pub(super) fn register(
@@ -248,8 +248,35 @@ fn parse_target(target: Dynamic) -> Result<InvokeTarget, Box<EvalAltResult>> {
 }
 
 /// Convert Rhai Dynamic → JSON. Rejects FnPtr at any depth (closures
-/// don't survive invoke boundaries).
+/// don't survive invoke boundaries) and is bounded by
+/// [`MAX_JSON_MATERIALIZE_BYTES`] so a cheaply-aliased huge args value can't OOM
+/// the node on materialization (same anti-OOM rail as `dynamic_to_json_capped`).
 fn args_to_json(value: &Dynamic) -> Result<Json, Box<EvalAltResult>> {
+    let mut remaining = MAX_JSON_MATERIALIZE_BYTES;
+    args_to_json_bounded(value, &mut remaining)
+}
+
+fn args_charge(remaining: &mut usize, n: usize) -> Result<(), Box<EvalAltResult>> {
+    match remaining.checked_sub(n) {
+        Some(left) => {
+            *remaining = left;
+            Ok(())
+        }
+        None => Err(EvalAltResult::ErrorRuntime(
+            format!(
+                "invoke: args too large to serialize (exceeds the {MAX_JSON_MATERIALIZE_BYTES}-byte limit)"
+            )
+            .into(),
+            rhai::Position::NONE,
+        )
+        .into()),
+    }
+}
+
+fn args_to_json_bounded(
+    value: &Dynamic,
+    remaining: &mut usize,
+) -> Result<Json, Box<EvalAltResult>> {
     if value.is::<rhai::FnPtr>() {
         return Err(EvalAltResult::ErrorRuntime(
             "invoke: args must not contain FnPtr / closures".into(),
@@ -259,40 +286,52 @@ fn args_to_json(value: &Dynamic) -> Result<Json, Box<EvalAltResult>> {
     }
     if value.is_blob() {
         let blob = value.clone().into_blob().unwrap_or_default();
-        return Ok(Json::String(STANDARD.encode(&blob)));
+        let encoded = STANDARD.encode(&blob);
+        args_charge(remaining, encoded.len() + 2)?;
+        return Ok(Json::String(encoded));
     }
     if value.is_unit() {
+        args_charge(remaining, 4)?;
         return Ok(Json::Null);
     }
     if let Ok(b) = value.as_bool() {
+        args_charge(remaining, 5)?;
         return Ok(Json::Bool(b));
     }
     if let Ok(i) = value.as_int() {
+        args_charge(remaining, 8)?;
         return Ok(Json::Number(i.into()));
     }
     if let Ok(f) = value.as_float() {
+        args_charge(remaining, 8)?;
         return Ok(serde_json::Number::from_f64(f).map_or(Json::Null, Json::Number));
     }
     if value.is_string() {
-        return Ok(Json::String(
-            value.clone().into_string().unwrap_or_default(),
-        ));
+        let s = value.clone().into_string().unwrap_or_default();
+        args_charge(remaining, s.len() + 2)?;
+        return Ok(Json::String(s));
     }
     if let Some(arr) = value.clone().try_cast::<Array>() {
-        let mut out = Vec::with_capacity(arr.len());
+        args_charge(remaining, 2)?;
+        let mut out = Vec::with_capacity(arr.len().min(1024));
         for v in &arr {
-            out.push(args_to_json(v)?);
+            args_charge(remaining, 1)?;
+            out.push(args_to_json_bounded(v, remaining)?);
         }
         return Ok(Json::Array(out));
     }
     if let Some(map) = value.clone().try_cast::<Map>() {
+        args_charge(remaining, 2)?;
         let mut out = serde_json::Map::new();
         for (k, v) in map {
-            out.insert(k.to_string(), args_to_json(&v)?);
+            args_charge(remaining, k.len() + 4)?;
+            out.insert(k.to_string(), args_to_json_bounded(&v, remaining)?);
         }
         return Ok(Json::Object(out));
     }
-    Ok(Json::String(value.to_string()))
+    let s = value.to_string();
+    args_charge(remaining, s.len() + 2)?;
+    Ok(Json::String(s))
 }
 
 /// `Limits` is `Copy`; passed by value into `register` so closures take