fix: bound graph-walk fan-out against the doubling-DAG DoS (#21)

[delta9000]

Bound graph-walk fan-out against the doubling-DAG DoS

Closes #21

Follow-up to the MEM-1 hardening (#20): the cycle+depth guards made the
extractor/pick/light walks crash-proof, but not DoS-proof against a
legitimate acyclic graph that fans out exponentially.

A "doubling DAG" — G0 children [G1,G1], G1 children [G2,G2], … ~30 deep, a
Shape at the leaf — has no containment back-edge (so breakContainmentCycles
leaves it intact) and stays far under the depth cap, yet the leaf is reachable
via 2^30 distinct paths. Per-path traversal then explodes into a CPU/memory DoS.

The fix differs by walker semantics

Per-path emission is intentional for USE-instancing (a node USE'd under N
placements legitimately yields N RenderItems/LightDescs/pick candidates, each in
its own world frame), so the emitters cannot be memoized — they must be
bounded. worldOf is the exception: a first-found search, fixed by
memoization.

Walker	Mechanism
SceneExtractor::walk	WalkBudget node-visit cap → budgetExceeded()
LightSystem::walk	shares the snapshot's budget → same budgetExceeded()
PickSystem::pickNode	WalkBudget (cap via pickClosest(..., maxVisits)) → PickResult.budgetExceeded
PickSystem::worldOfRec	visited-set memoization — O(paths)→O(nodes), result unchanged

WalkBudget + kMaxGraphWalkVisits (default 1'000'000, overridable via
MeshBuildOptions.maxWalkVisits) live in runtime/RecursionLimits.hpp. Overflow
is a graceful, non-throwing signal (the extractor/pick are read paths), so a
capped walk returns a partial result plus the flag for an embedder to react.

Definition of Done

• TDD: worldOf(absent) on a 2⁴⁵ DAG is a runtime RED (non-terminating
  pre-fix; instant post-memoization). The budget cases assert budgetExceeded +
  bounded itemCount(); a small scene never trips the cap.
• mise run ci green (build/golden/conformance/coverage/cli-gate).
• Codegen-free → golden binding hash byte-identical.
• Per-header self-containment verified for the touched headers.
• Living docs in-diff: ADR-0037 (binding embedder-visible contract;
  extends ADR-0016 from crash-proof to DoS-bounded), coverage.md row + count,
  mkdocs.yml nav, extract.md interface note. Design spec under
  docs/superpowers/specs/.
• No new third-party dependency → NOTICE unchanged.

Code review

A fresh-context adversarial review verified the budget machinery (latch/off-by-one,
reset placement, shared-budget threading, MEM-1 ordering) and caught one real
correctness bug, now fixed: worldOfRec marked a node visited at entry, but
a node first reached near the MEM-1 depth cap has its subtree truncated — marking
it then wrongly pruned a shallower path on which the target was findable, returning
identity. The fix memoizes a node only when its subtree was fully explored (an
incomplete flag propagates depth-truncation up), pinned by a new regression
(worldof_depth_truncated_subtree_is_not_falsely_memoized). Two review minors also
applied: the extractor test's decorative itemCount assertion was corrected (the
doubling DAG reuses node pointers → one interned PathKey; budgetExceeded() is
the load-bearing signal), and the cap comment now states it counts node-visits
(shared across light + geometry), not RenderItems.

New test

runtime/scene/tests/walker_budget_test.cpp — worldOf memoization (absent
terminates / present correct / depth-truncated subtree not falsely memoized),
extractor + light + pick budget trips on a doubling DAG, and a no-trip guard for
a legitimate small scene.