fix(config): clamp max_edit_size and max_search_results

Only max_file_size and max_parse_size were clamped after reading .mcp-filepuff.json; max_edit_size and max_search_results were unbounded, letting a config file request excessive memory. Clamp max_edit_size to 100MB and max_search_results to 100k (and floor negatives to 0). Adds TestLoadClampsExcessiveLimits.

internal/config/config.go

@@ -84,14 +84,24 @@ func Load(workspaceRoot string) (*Config, error) {
 	// Restore WorkspaceRoot — config file must not override path guards.
 	cfg.WorkspaceRoot = savedRoot
 
-	// Clamp size limits to prevent config file from requesting excessive memory.
+	// Clamp size/count limits so the config file cannot request excessive memory.
 	const maxAllowedSize int64 = 100 * 1024 * 1024 // 100 MB
+	const maxAllowedSearchResults = 100000
 	if cfg.MaxFileSize > maxAllowedSize {
 		cfg.MaxFileSize = maxAllowedSize
 	}
 	if cfg.MaxParseSize > maxAllowedSize {
 		cfg.MaxParseSize = maxAllowedSize
 	}
+	if cfg.MaxEditSize > maxAllowedSize {
+		cfg.MaxEditSize = maxAllowedSize
+	}
+	if cfg.MaxSearchResults > maxAllowedSearchResults {
+		cfg.MaxSearchResults = maxAllowedSearchResults
+	}
+	if cfg.MaxSearchResults < 0 {
+		cfg.MaxSearchResults = 0 // negative would re-enable unbounded search
+	}
 
 	// Override from environment variables
 	cfg.loadFromEnv()