feat: add import safety limits

[snkmcb]

Summary

• Add a shared 8,000,000 Gaussian import ceiling across PLY, SPZ, and SOG.
• Bound SPZ payload allocation and extension records.
• Bound SOG metadata, JSON values, ZIP entries and expansion, WebP planes, companions, and duplicate names.
• Add stable resource-limit diagnostics, fixtures, tests, and documentation.
• Record the limits in the model contract and v0.6.0 roadmap.

Validation

• ctest --test-dir build/cy2026-windows-x86_64-py313-usd --output-on-failure
• 13/13 tests passed, including Python smoke and equivalence tests.
• scripts/check_clang_format.py --changed
• git diff --check