fix(binding): reject oversized final-value allocations

[jmgilman]

Summary

• reject oversized tuple, list, and dictionary final values before proportional destination allocation
• allocate only from node-budget-validated container lengths and stream dictionary iteration instead of materializing Dict.Items()
• add an allocation regression covering all three container converters

Verification

• regression fails on master: tuple 2,067,136 bytes; list 2,064,480 bytes; dictionary 17,680,784 bytes
• go test ./internal/binding -count=1
• public four-million-element Server.Execute reproduction: allocation reduced from 128,034,304 bytes to 64,013,840 bytes while preserving ErrResourceLimit
• mise exec -- moon run root:check
• gopls diagnostics: clean for both changed files

The remaining Starlark source allocation is outside final-value conversion; process isolation remains necessary for a hard heap boundary.

Closes #13