fix: runtime owns resource-limit defaults; client sends only explicit overrides

[schplitt]

Closes #39.

Problem

The default limits (64 MB memory, 5 s CPU, 30 s wall, 10 bridge calls, 16 MiB export/bridge-payload caps, 1 MiB stdio caps) were filled in client-side in toWireLimits() before every Run/Precompile/PrefixRun, so the wire always carried concrete values. The same numbers were documented in three places (TS code, types.ts jsdoc, Rust doc comments) that could drift, and any non-TS client had to re-implement them to get safe behavior.

Change

The runtime now owns its own safety posture.

• Wire: each ResourceLimits field is now Optional<u32> (per the existing Optional<T> framing convention). The client sends only the fields the caller explicitly set. Absent → runtime applies its default; explicit 0 → limit disabled (distinct from absent).
• Rust (ipc.rs): a single set of DEFAULT_* constants is the source of truth. A new read_resource_limits() reads the eight optionals and resolves any absent field to its default. Downstream (v8.rs, session.rs) is unchanged — the resolved struct keeps the same 0 = no limit semantics.
• TS: toWireLimits() (the client-side default-filler) is deleted; options.limits flows straight through. Encoding uses a new writeOptionalU32.
• Public types (types.ts): ResourceLimits fields become optional and call sites take ResourceLimits instead of Partial<ResourceLimits>. The @default jsdoc is kept and now documents the numbers the runtime fills in (pointing at ipc.rs as the source of truth).
• Dedup: the duplicate wire-local ResourceLimits interface in ipc.ts (identical once the public one went optional) is removed; ipc.ts/client.ts import the public type. Single source of truth.
• Docs: docs/protocol.md §5.2 updated (encoding, per-field defaults column, absent-vs-explicit-0 semantics).

Effective behavior for existing callers is unchanged — the defaults are identical.

Notes

• Wire-protocol change (limits payload shape). @iso4/sandbox and the @iso4/v8-* binaries must ship together; the changeset bumps all five in lockstep. Protocol version not bumped (pre-v1, per repo owner).
• Changeset uses minor, consistent with the other pending breaking/notable changes this cycle — adjust if you'd rather it be patch (consumer-visible behavior is unchanged).

Verification

• Rust: cargo test ipc suite green, incl. two new tests — absent limits resolve to DEFAULT_*, and an explicit 0 is preserved (not replaced by the default).
• TS: full @iso4/sandbox suite 454 passed | 1 skipped against a freshly-rebuilt native binary (exercises the new optional wire path end-to-end).
• typecheck, eslint (0 errors on touched files), cargo fmt --check all clean.