Bound desktop bitfields by authenticated piece counts

[linroid]

Allows the required desktop one-million-piece bitfield using exact bounds derived from a trusted piece count. The default and all unrelated message types keep the existing 64 KiB ceiling. Peer readers inspect the message ID and bitfield size before reading the remaining body, enforce spare bits and piece indices, and retain admitted frame credit through dispatch. Availability state uses the same one-million-piece ceiling.

Stacked on #189, including its write-deadline review fix; advances step 08 of #162. V1 metadata supplies its own count; v2 callers can supply the authenticated layout count without synthesized SHA-1 hashes. This removes the wire-size obstacle, but does not establish aggregate resource/RSS gates or full v2 runtime support.

Validation: all 415 JVM torrent tests and all 394 iOS simulator torrent tests execute and pass with zero failures/errors/skips. Both pinned-client v1 conformance scenarios and the native-runtime guard pass. Tests cover desktop boundary bitfields, padding and index bounds, oversized unrelated messages rejected before body reads, frame reservation lifetime, and the inherited backpressured-write deadline regression.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T16:59:17.174927Z	3b1f9cf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Test Results

  622 files  + 5    622 suites  +5   4m 19s ⏱️ +18s
2 624 tests + 9  2 624 ✅ + 9  0 💤 ±0  0 ❌ ±0 
3 452 runs  +15  3 452 ✅ +15  0 💤 ±0  0 ❌ ±0 

Results for commit 3b1f9cf. ± Comparison against base commit bd9c0a8.

[linroid]

Superseded by #235 (V2 handshake, hash exchange and bounded transport) in the consolidated eight-PR stack for #162.

The replacement preserves this PR's code and subsequent fixes; its description links the original head and review discussions. The only additional consolidation fix is the CI-discovered listener cancellation regression, documented on the replacement. All eight replacements have passed their required CI checks.

Closing without merging. This branch and its discussions remain available for reference. Review index: #162 (comment)