feat(worker): add bounded protocol framing

[jmgilman]

Summary

• add the private internal/worker frame protocol with uint32 big-endian length prefixes and allocation-before-cap checks
• strictly decode concrete frame types and preserve exact int64 versus finite float64 JSON values
• validate manifests, execution limits, payload-cap arithmetic, and parent/child state transitions
• cover framing, numeric, bound, and lifecycle invariants with the Increment 3 test matrix

Verification

• mise exec -- golangci-lint run --config .golangci.yml ./internal/worker/... --show-stats=false
• mise exec -- go test ./internal/... -count=1 -timeout=60s
• mise exec -- go test ./internal/worker -run '^(TestFrame|TestProtocol|TestValueCodec|TestFrameLimits)' -count=1 -timeout=60s
• persistent bounded review: zero merge blockers

Scope

Part of the worker-isolation remediation for #12. This increment adds no process launcher or public protocol and does not close the issue; deterministic child supervision follows in Increment 4.