Bound and exactly consume external bincode payloads #1672

Audit reference: I28

What can go wrong

An external bincode payload could declare a huge collection or hide extra trailing bytes after an otherwise valid object.

When it happens

The decoder is used at network and persistence boundaries where payload length or contents may be corrupt or attacker-controlled.

What changed

Decoding now has byte and allocation limits, uses the expected fixed-integer format, and must consume the input exactly.

Why the change works

Forged lengths cannot trigger unbounded allocation, and ambiguous payloads with hidden suffixes are rejected.

Checks

Over-budget, forged-length, trailing-byte, and current-format tests pass.