feat(ocap-kernel): add resource limits for remote communications

[sirtimid]

Closes #660

• Add connection limit (default 100 concurrent connections)
• Add message size limit (default 1MB per message)
• Add stale peer cleanup (removes data for peers disconnected >1 hour)
• Make all limits configurable via RemoteCommsOptions
• Add ResourceLimitError for limit violations
• Add comprehensive tests for all resource limits

This prevents memory exhaustion and manages system resources by:

• Rejecting new connections when limit is reached
• Rejecting messages exceeding size limit
• Periodically cleaning up stale peer data

---

Note

Enforces connection and message-size limits with stale peer cleanup, adds ResourceLimitError, and updates reconnection and stream-closing logic.

• ocap-kernel (remotes):
  • Resource limits:
    • Enforce max concurrent connections (default 100) on outbound and inbound paths with race-condition safeguards.
    • Enforce max message size (default 1MB) via pre-send validation.
    • Periodic stale peer cleanup (default every 15m; peers stale after 1h) with tracking of lastConnectionTime.
    • All limits configurable via RemoteCommsOptions (maxConcurrentConnections, maxMessageSizeBytes, cleanupIntervalMs, stalePeerTimeoutMs).
  • Reconnection: Respects connection limit, continues retries if blocked; flushes queues with timeout-protected writes; centralized give-up handling.
  • Inbound handling: Rejects connections when limits reached; ignores intentionally closed peers.
  • Utilities: Add closeChannel in ConnectionFactory to close/abort underlying stream; add registerChannel, checkConnectionLimit, validateMessageSize helpers.
  • Tests: Comprehensive coverage for limits, cleanup, reconnection behavior, race conditions, and close/abort paths.
• kernel-errors:
  • New ResourceLimitError: Code RESOURCE_LIMIT_ERROR, marshaling schema/validation and unmarshal support; exported and mapped in errorClasses with tests.

^{Written by Cursor Bugbot for commit 8e04986. This will update automatically on new commits. Configure here.}