feat: add size limits to CAR parser

reject CAR data > 2MB and block count > 10,000, matching indigo's
safety limits. removes the last correctness asymmetry in the benchmarks.

Co-Authored-By: Claude Opus 4.6 <[e-mail]>

src/internal/repo/car.zig

···
     UnexpectedEof,
     OutOfMemory,
     BadBlockHash,
+    BlocksTooLarge,
+    TooManyBlocks,
 };
+
+/// match indigo's safety limits
+const max_blocks_size: usize = 2 * 1024 * 1024; // 2 MB
+const max_block_count: usize = 10_000;
 
 pub const ReadOptions = struct {
     /// verify that each block's content hashes to its CID.
···
 
 /// parse a CAR v1 file from raw bytes with options
 pub fn readWithOptions(allocator: Allocator, data: []const u8, options: ReadOptions) CarError!Car {
+    if (data.len > max_blocks_size) return error.BlocksTooLarge;
+
     var pos: usize = 0;
 
     // read header length (unsigned varint)
···
         if (options.verify_block_hashes) {
             try verifyBlockHash(cid_bytes, content);
         }
+
+        if (blocks.items.len >= max_block_count) return error.TooManyBlocks;
 
         try blocks.append(allocator, .{
             .cid_raw = cid_bytes,