fix(session): bound managed source admission

[andrei-hasna]

Fixes Todos task e3a7fe9f-3e59-4605-b153-3ab8fc9df63c.\n\nRoot cause:\n- @hasna/instructions 0.4.22 read managed session-render homes through the 256 KiB foreign-input cap, so a valid managed corpus above 262144 bytes wedged future applies with PROJECT_CONTEXT_INPUT_TOO_LARGE.\n- Current main already repaired managed-home observation/write bounds, but explicit --source files still had no named managed-input admission gate before render planning.\n\nChange:\n- Adds SESSION_MANAGED_INPUT_MAX_BYTES as the explicit session source input contract, tied to the managed output/read bound.\n- Reads --source files through a regular-file, non-symlink, bounded admission helper.\n- Adds focused CLI regression coverage: valid >256 KiB source passes twice, oversized source refuses before writes, symlink source refuses before reads.\n\nValidation:\n- 0.4.22 synthetic repro: first_rc=0, second_rc=1, stderr PROJECT_CONTEXT_INPUT_TOO_LARGE: managed input exceeds 262144 bytes.\n- Fixed synthetic repro on branch: first_rc=0, second_rc=0.\n- bun test src/cli/session-apply-managed-input-bound.test.ts src/lib/project-context.test.ts src/lib/session-render-managed-output-bound.test.ts: 73 pass, 0 fail.\n- bun test: 638 pass, 0 fail.\n- bun run typecheck: tsc --noEmit passed.\n- bun run build: passed.\n- bun run kit:check: ok storage-kit check.\n- repo package-manager scan: clean (2 files).\n- staged_secret_scan_files=3; staged_secret_scan_findings=0.\n- push_secret_scan_files=3; push_secret_scan_findings=0.\n\nNote:\n- bun run check:package-secrets with --home fails on pre-existing station ~/.bunfig.toml broad release-age excludes, outside this repository diff. I did not mutate machine config or widen scope.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO for exact candidate 9fe30cc..95eecbb.

Checked gates: exact diff is three files (+137/-1); current main/baseRefOid/head parent all equal 9fe30cc; explicit --source admission now lstat-checks a regular non-symlink file, rejects paths above SESSION_MANAGED_INPUT_MAX_BYTES before plan/apply, and uses the same 8 MiB bound as managed output/read; valid >262144-byte source is covered by a twice-applied CLI regression; oversized and symlink sources fail closed without AGENTS.md writes; existing managed-output/read lane remains coherent and covers refusal-before-write, ordinary applies, warning-only headroom, and recovery after refusal; renderer composes source.content without truncation/dropping; Ubuntu and macOS CI for head 95eecbb ran package-manager secret guard, typecheck, full bun test, and build successfully; changed hunks contain no candidate-introduced credential material.

No P0/P1 blockers found. Do not merge on this comment alone if the head changes.