Harden shard readers and server surfaces

[phenomenon0]

Summary

• harden shard readers and server-facing surfaces across C, Go, Rust, and TypeScript
• close decompression-bomb and offset-overflow gaps
• add focused regressions for the audited issues

Included

• C: overflow-safe entry offset/range validation in shard_v2
• Go: request body limits, token caps, strict JSON decode, and HTTP timeouts for cmd/ucodec --serve
• Rust: bounded zstd decompression and stricter range handling in readers
• TypeScript: bounded zstd decompression and regression coverage

Verification

• cd shard/c && make test_writer test_metadata test_streaming test_compression && ./test_writer && ./test_metadata && ./test_streaming && ./test_compression
• cd shard/rs && cargo test --test compression_test --test fuzz_seeds_test --test metadata_test --test schema_test --test streaming_test --test writer_test
• cd shard/ts && npm test
• cd shard/ts && npm run build

Remaining Blockers

• fixture-backed golden/safety suites still require the external ucodec/testdata corpus in this workspace
• shard/go/cmd/ucodec still depends on unresolved existing Agent-GO module imports, so full build validation is blocked on dependency restoration