Bound small probe responses before they bypass byte accounting

[korya]

The client drains an arbitrarily large small-endpoint response while charging only the fixed per-probe estimate. A malformed or misconfigured endpoint can therefore exceed the caller's byte budget and distort latency measurements.

doProbe uses unbounded io.Copy(io.Discard, resp.Body). The scheduler accounts for 5000 bytes per foreign probe and 1000 per self probe, assuming a small protocol response.

Evidence from the project review:

• A local TLS server advertised a small endpoint returning 1 MiB; the large endpoint flushed headers and stalled without sending payload.
• Run download only with idle probes disabled, MaxDuration=500ms, and MaxBytes=10000.
• The probe endpoint sent 1,048,576 bytes, while the result reported 10,000 bytes and reason=bytes_cap.

Relevant code: probe body read, probe accounting.

Acceptance criteria:

• Establish the allowed small-response size from the supported protocol and reject invalid responses using a bounded read.
• Cover known Content-Length and chunked/unknown-length bodies, as well as stalled bodies, for idle, foreign, and self probes.
• Do not silently accept an oversized response as a valid latency sample.
• Document the scope of estimated probe cost and transport buffering; avoid promising exact wire-byte accounting.
• Keep ordinary payload accounting and valid probe behavior intact, with regression tests, spec/matrix updates, and a changelog entry.

Related: INV-1, INV-3, LIM-2, LAT; the fixes must complement the idle-deadline issue. Wire behavior must be checked against the draft and README deviations.