fix: support bounded larger JSON quote ownership and explain limits

[mohgupta-ship-it]

Prepared by Codex on behalf of Mohit.

Valid JSON above 65,536 source characters could leave structural quotes unproven and produce incomplete instruction analysis. This change supports complete candidates through 131,072 raw source characters using an iterative grammar validator, and explains remaining capacity limits with json_quote_ownership_limit and source coordinates.

The larger-input validator advances without recursion or decoded-value allocation, bounds its normalized validation copy, and checks cancellation throughout strings, numbers, whitespace, and container parsing. Quotes gain ownership only after the entire candidate validates. The established small-input decoder and independent frontmatter bound remain in place; a failed small decode is never retried through the new path.

Real commands and reconstructed instructions remain subject to the existing analyzers. Other parser, reconstruction, window, or runtime limitations can still make analysis incomplete. Capacity diagnostics preserve existing findings and CLI/MCP rejection, including after mocked successful semantic analysis. Unknown future reason codes also remain conservative in CLI, MCP, and SARIF consumers.

Compatibility: otherwise supported benign values between the old and new limits can now complete and change strict CLI exit status. Historical rejection expectations require an explicit versioned migration; no duplicate legacy reason is emitted to satisfy old predicates. The migration note marks this as an unreleased change after the 2.12.0 baseline.

Validation at aceb7ba7fb3fe99c8987b51f900665aa73b32103:

• 1,648 focused tests passed, covering strict grammar and differential mutations, depth and dense strings, malformed/truncated candidates, work and cancellation bounds, raw Unicode/CRLF offsets, new size boundaries, adjacent commands, recovered scan windows, and public consumer gates.
• Ruff lint and formatting passed for source/tests; the changed reconstruction module passed mypy; git diff --check passed.
• No live-provider or full-corpus result is claimed by these focused checks.