pds: the commit size gate misses the sync spec's limits: a record over 1,000,000 bytes is accepted, and tree nodes are not counted #236

What happens. The sync spec sets two hard limits on a #commit. "individual record blocks within the blocks field have a hard limit of one million bytes", and "the blocks bytes field has a hard size limit of 2 million bytes". The write gate sums only the record blocks against 2,000,000, and nothing enforces the 1,000,000 limit for one record. So a single 1.5 MB record is accepted. A record that just passes the 2,000,000 check produces a commit whose blocks are over 2,000,000. The CAR header, the signed commit and the tree nodes of the covering proof are not counted.

How to reproduce.

• require_commit_fits (crates/didbot-pds/src/provision/write.rs:633-660) adds section_len for each distinct record and compares the total with MAX_COMMIT_BLOCKS (crates/didbot-pds/src/subscribe.rs:50). It is the only commit-size check, called at write.rs:384 and crates/didbot-pds/src/provision/registry.rs:844.
• The firehose blocks are the created blocks, the covering proof and the records (crates/didbot-pds/src/provision/mod.rs:751-758).
• A local probe built a 3,000-record repo and added one record whose CAR section is exactly 2,000,000 bytes, which the gate admits. Building the blocks as Committed::blocks does gave 2,003,934 bytes.
• The request body limit is 2 MiB (crates/didbot-serve/src/routes/mod.rs:1217), so a 1-2 MB record fits through it.

Why it matters. A relay that applies the spec's limits drops these commits, and the account then falls out of sync with the network until it is resynced. Any account can trigger this with one ordinary write.