fix(core): bound bracketed-paste memory retention

[HARIOM-JHA01]

Fixes #1270

What

An unterminated bracketed paste (ESC[200~ with no matching ESC[201~) grew memory without bound and left the StdinParser stuck in paste mode. This PR bounds the memory retained for a single paste and makes over-limit pastes fail visibly instead of leaking bytes.

Invariants satisfied

• A paste whose body is at or below the limit emits exactly one unchanged paste event.
• A paste whose body exceeds the limit is dropped in full when its end marker arrives — no truncated event, and no body bytes leak into key/mouse/response events.
• The parser keeps scanning an oversized paste for ESC[201~ using only a small sliding tail, so a marker split across chunks or across the size boundary is still recognized and normal input resumes afterward.
• Recovery from a missing end marker remains an explicitly documented policy distinct from size enforcement: there is no automatic recovery (bytes are indistinguishable from delayed paste content), retention is bounded, and reset/destroy clears paste state.

How

• packages/core/src/lib/stdin-parser.ts adds maxPasteBytes (default 16 MiB) to StdinParserOptions and PasteCollector.overLimit. Once an accumulated body would exceed the limit, pushPasteBytes stops retaining and frees parts; consumePasteBytes still scans for the end marker but skips emitting the paste event.
• packages/core/src/lib/stdin-parser.test.ts adds six regression tests covering the limit boundary, full drop, no event leakage, recovery after the marker, a marker split across the size boundary, and a paste split across many small chunks.

Testing

• bun test src/lib/stdin-parser.test.ts: 427 passed, 0 failed.
• bunx oxfmt --check and bunx oxlint clean on both changed files.