feat(sanitize,fence,neutralize): reject oversize input instead of half-transforming it

The scanners cap by truncating: they return findings, so reading a prefix costs
detection in the tail and nothing else. The three transform surfaces return
*content*, where the same move is not available — a shortened document is silent
data loss, and a transformed prefix followed by an untransformed tail is a
bypass, since the attacker chooses where in the document the payload sits.

So they fail secure instead. Above MAX_INPUT_CHARS (1 000 000) sanitize, fence
and neutralize raise OversizeInputError. sanitize is step 1 of prepare_input and
only ever removes, so that one refusal bounds the whole input path.

OversizeInputError subclasses ContractViolation: a pipeline already bracketing
its quarantined stage keeps failing closed rather than meeting a type it has
never heard of. It inherits the alert-routable property too — sizes in the
message, refusing surface in details, no input in either.

Invariant now pinned across all three: returned text is always fully
transformed, or not returned at all.

Still uncapped and recorded in LIMITATIONS: scan_active_content called directly
(through scan_output it inherits that cap) and the okf link graph. Both are
detection-shaped, so truncate-and-flag transfers unchanged — mechanical, not
policy.

699 tests (+23), coverage 128/128 + 6/6, ReDoS sweep 0 candidates / 150.

src/llm_ingestion_guard/__init__.py

@@ -48,9 +48,11 @@ from .disposition import (
 from .contract import (
     assert_tool_less,
     assert_credential_allowlist,
+    assert_within_input_cap,
     credential_env_names,
     scoped_env,
     ContractViolation,
+    OversizeInputError,
 )
 from .grounding import (
     SourceGroundingCheck,
@@ -140,6 +142,7 @@ __all__ = [
     # contract asserters
     "assert_tool_less", "assert_credential_allowlist",
     "credential_env_names", "scoped_env", "ContractViolation",
+    "assert_within_input_cap", "OversizeInputError",
     # grounding seam
     "SourceGroundingCheck", "no_grounding_check", "DEFAULT_GROUNDING_CHECK",
     # §6 bookends