feat(active-content,okf): bound the last two detection surfaces

`scan_active_content` called directly and `okf.link_graph` were the two surfaces
still reading attacker-supplied text with no cap — the first reached by an
adapter that wants the active-content classes alone, the second running a
`findall` over every body in a bundle. Both are detection-shaped, so they
truncate and flag rather than raise the way the transform surfaces do: what a
detector shortens is its own coverage, not the caller's content.

Truncation is only honest if it is visible, so neither goes quiet: the scanner
emits `active:oversize-input` (LLM10), and `link_graph` records
`(from_id, body_length)` in `LinkGraphResult.truncated` — the field that lets a
caller tell "no links past here" from "no links read past here".

Reached through `scan_output`, the text is already under that surface's cap and
`max_scan_chars` is now passed down, so the flag is raised once, there.

docs/LIMITATIONS.md

@@ -302,21 +302,25 @@ items; this is the full list, each with the mechanism.
   *closes* around a long body, and a run of plain characters carrying no anchor
   at all.
 
-- **Two detection surfaces still accept unbounded input; the transform surfaces
-  no longer do.** Unreleased, on `main` at `2d98d68`: `sanitize`, `fence` and
-  `neutralize` raise
-  `OversizeInputError` above `MAX_INPUT_CHARS` (1 000 000) rather than returning
-  a partially transformed document, which bounds the whole input path — `sanitize`
-  is step 1 of `prepare_input`, and it only ever removes, so everything after it
-  is already under the cap. They reject rather than truncate because they return
-  *content*: a shortened document is silent data loss, and a transformed prefix
-  followed by an untransformed tail is a bypass an attacker positions the payload
-  into. The scanners keep truncating, which costs only detection in the tail.
-  What remains uncapped is `scan_active_content` **called directly** (reached
-  through `scan_output` it inherits that cap) and the okf link graph, whose cost
-  is a bundle-wide `findall` over every document body. Both are detection-shaped,
-  so the scanners' truncate-and-flag mechanism transfers to them unchanged — that
-  is a mechanical follow-up, not a policy question, and it is not yet done.
+- **Every surface now bounds its input, but not all of them the same way.**
+  `sanitize`, `fence` and `neutralize` raise `OversizeInputError` above
+  `MAX_INPUT_CHARS` (1 000 000) rather than returning a partially transformed
+  document, which bounds the whole input path — `sanitize` is step 1 of
+  `prepare_input`, and it only ever removes, so everything after it is already
+  under the cap. They reject rather than truncate because they return *content*:
+  a shortened document is silent data loss, and a transformed prefix followed by
+  an untransformed tail is a bypass an attacker positions the payload into. The
+  detection surfaces truncate instead, which costs only detection in the tail —
+  `scan_lexicon` / `scan_output` always have, and as of 0.4.0
+  `scan_active_content` **called directly** does too (reached through
+  `scan_output` it inherits that surface's cap and is not flagged twice), as does
+  `okf.link_graph`, whose cost was a bundle-wide `findall` over every document
+  body. **What truncation costs is worth naming: past the cap, "no finding" means
+  "not looked at".** Each says so rather than staying silent — the scanners emit
+  an `oversize-input` finding (`active:oversize-input`, OWASP LLM10), and
+  `link_graph` records `(from_id, body_length)` in `LinkGraphResult.truncated`,
+  which is what lets a caller tell "no links past here" apart from "no links
+  *read* past here".
 
 ## The six documented gaps (tracked by the coverage matrix)