fix(executor): bound Rhai→JSON materialization to prevent anonymous OOM

The per-element Rhai sandbox caps (max_string_size 64 KiB, max_array_size /
max_map_size 10 000) do NOT bound the *materialized* size: Rhai shares strings
and arrays by Rc, so a 10 000-element array of one aliased 64 KiB string is
cheap to build (~10 000 ops, far under the 1 M op budget) yet dealiases to
~640 MiB of distinct JSON. Every Dynamic→JSON conversion deep-copies the
aliases; the HTTP response body path had NO size cap at all, and the KV/docs
value caps run only AFTER full materialization — so a handful of anonymous
requests could OOM the node (32 concurrent × ~640 MiB ≈ 20 GiB) on the stated
consumer-hardware target.

Add a byte-budgeted materializer that bails the moment the budget is exceeded,
so the transient allocation is bounded regardless of aliasing:
- bridge.rs: `dynamic_to_json_capped(value, max) -> Result<Json, JsonSizeError>`
  (charges a running budget) + `MAX_JSON_MATERIALIZE_BYTES` (16 MiB hard rail,
  far above the 256 KiB business caps). `dynamic_to_json` stays infallible for
  best-effort paths (logging) but is now internally bounded — it collapses an
  over-limit value to a marker string instead of OOMing.
- Route every user-value boundary through the fail-closed capped form: KV
  set/set_if (+ the CAS `expected`), docs create/update/find, secrets set,
  http request body, workflow input, `json::stringify`, and the HTTP RESPONSE
  body (previously the one fully-uncapped exit → now a 500). `invoke` args and
  the pubsub/queue message materializers get the same byte budget in place.
- `impl From<JsonSizeError> for Box<EvalAltResult>` so SDK sites protect
  themselves with a bare `?`.

Pinned by bridge unit tests: an aliased 10 000×64 KiB array errors on the
budget rather than materializing, and the infallible wrapper yields a marker
instead of OOMing. Workspace 914 + journeys 157/157 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/kv.rs

@@ -33,7 +33,9 @@ use std::sync::Arc;
 use picloud_shared::{GroupKvService, InterceptorService, KvService, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 
-use super::bridge::{block_on, dynamic_to_json, json_to_dynamic};
+use super::bridge::{
+    block_on, dynamic_to_json_capped, json_to_dynamic, JsonSizeError, MAX_JSON_MATERIALIZE_BYTES,
+};
 use crate::engine::Engine;
 use crate::sandbox::Limits;
 
@@ -154,11 +156,14 @@ pub(super) fn register(
 /// Map a Rhai `expected` argument to the CAS precondition: Rhai unit `()` means
 /// "expected ABSENT" (insert-if-absent); any other value is the expected current
 /// value.
-fn expected_from_dynamic(expected: &Dynamic) -> Option<serde_json::Value> {
+fn expected_from_dynamic(expected: &Dynamic) -> Result<Option<serde_json::Value>, JsonSizeError> {
     if expected.is_unit() {
-        None
+        Ok(None)
     } else {
-        Some(dynamic_to_json(expected))
+        Ok(Some(dynamic_to_json_capped(
+            expected,
+            MAX_JSON_MATERIALIZE_BYTES,
+        )?))
     }
 }
 
@@ -179,7 +184,7 @@ fn register_set(engine: &mut RhaiEngine) {
     engine.register_fn(
         "set",
         |handle: &mut KvHandle, key: &str, value: Dynamic| -> Result<(), Box<EvalAltResult>> {
-            let json = dynamic_to_json(&value);
+            let json = dynamic_to_json_capped(&value, MAX_JSON_MATERIALIZE_BYTES)?;
             // §9.4 before-op interceptor (allow/deny). A denial errors here and
             // the write below never runs.
             super::interceptor::run_before(
@@ -213,8 +218,8 @@ fn register_set_if(engine: &mut RhaiEngine) {
          new: Dynamic|
          -> Result<bool, Box<EvalAltResult>> {
             let h = handle.clone();
-            let exp = expected_from_dynamic(&expected);
-            let new = dynamic_to_json(&new);
+            let exp = expected_from_dynamic(&expected)?;
+            let new = dynamic_to_json_capped(&new, MAX_JSON_MATERIALIZE_BYTES)?;
             block_on("kv", async move {
                 h.service.set_if(&h.cx, &h.collection, key, exp, new).await
             })
@@ -343,7 +348,7 @@ fn register_group_set(engine: &mut RhaiEngine) {
     engine.register_fn(
         "set",
         |handle: &mut GroupKvHandle, key: &str, value: Dynamic| -> Result<(), Box<EvalAltResult>> {
-            let json = dynamic_to_json(&value);
+            let json = dynamic_to_json_capped(&value, MAX_JSON_MATERIALIZE_BYTES)?;
             // §9.4 before-op interceptor also guards shared-collection writes.
             group_run_before(handle, "set", key, Some(&json))?;
             let h = handle.clone();
@@ -363,8 +368,8 @@ fn register_group_set_if(engine: &mut RhaiEngine) {
          new: Dynamic|
          -> Result<bool, Box<EvalAltResult>> {
             let h = handle.clone();
-            let exp = expected_from_dynamic(&expected);
-            let new = dynamic_to_json(&new);
+            let exp = expected_from_dynamic(&expected)?;
+            let new = dynamic_to_json_capped(&new, MAX_JSON_MATERIALIZE_BYTES)?;
             block_on("kv", async move {
                 h.service.set_if(&h.cx, &h.collection, key, exp, new).await
             })