feat(sanitize,fence,neutralize): reject oversize input instead of half-transforming it

The scanners cap by truncating: they return findings, so reading a prefix costs
detection in the tail and nothing else. The three transform surfaces return
*content*, where the same move is not available — a shortened document is silent
data loss, and a transformed prefix followed by an untransformed tail is a
bypass, since the attacker chooses where in the document the payload sits.

So they fail secure instead. Above MAX_INPUT_CHARS (1 000 000) sanitize, fence
and neutralize raise OversizeInputError. sanitize is step 1 of prepare_input and
only ever removes, so that one refusal bounds the whole input path.

OversizeInputError subclasses ContractViolation: a pipeline already bracketing
its quarantined stage keeps failing closed rather than meeting a type it has
never heard of. It inherits the alert-routable property too — sizes in the
message, refusing surface in details, no input in either.

Invariant now pinned across all three: returned text is always fully
transformed, or not returned at all.

Still uncapped and recorded in LIMITATIONS: scan_active_content called directly
(through scan_output it inherits that cap) and the okf link graph. Both are
detection-shaped, so truncate-and-flag transfers unchanged — mechanical, not
policy.

699 tests (+23), coverage 128/128 + 6/6, ReDoS sweep 0 candidates / 150.

src/llm_ingestion_guard/fence.py

@@ -24,6 +24,8 @@ import re
 import secrets
 from dataclasses import dataclass
 
+from .calibration import MAX_INPUT_CHARS
+from .contract import assert_within_input_cap
 from .report import Finding, Report, Severity, Source
 
 # Static delimiter skeleton. The per-call nonce is the security boundary; this
@@ -59,9 +61,21 @@ def _redact(s: str, show_start: int = 16, show_end: int = 5) -> str:
     return f"{s[:show_start]}...{s[-show_end:]}"
 
 
-def fence(text: str, source: Source = Source.INPUT) -> FenceResult:
+def fence(
+    text: str,
+    source: Source = Source.INPUT,
+    max_input_chars: int = MAX_INPUT_CHARS,
+) -> FenceResult:
     """Strip fabricated fence markers from ``text``, then wrap it in a
-    randomized, unspoofable delimiter."""
+    randomized, unspoofable delimiter.
+
+    Raises :class:`~llm_ingestion_guard.contract.OversizeInputError` above
+    ``max_input_chars``. Reached through :func:`prepare_input` the text is
+    already bounded (``sanitize`` only ever removes), so the guard matters for
+    direct callers — and there it is load-bearing: a fence whose *body* was
+    truncated would present unstripped attacker markers as fenced data.
+    """
+    assert_within_input_cap(text, surface="fence", max_input_chars=max_input_chars)
     report = Report()
 
     # 1. Strip attacker fence markers FIRST — otherwise a lucky guess of the