[yhay81]

Closes #733

What changed

Enforce DocumentLimits.max_interpretation_size on the length of each PDF input supplied by the hayro bridge. The file prefix is checked before appearance synthesis. The output buffer enforces its own inclusive length limit as it reserves and appends, including written objects, render-only appearances and the cross-reference stream. Cached bridges are checked against the current caller's budget. Store-only edits and saves keep their existing behavior.

The public API reference describes the bytes covered. The form and link tests now exercise the actual bridge representation, including the ability to read a document after a refused import. Decoder working memory and interpreter work remain tracked separately in #48 and #105.

Validation and next action

• Before the fix all ten public-reader cases (text, words, paths, content and pixmap, original and edited) failed to raise the expected limit. Both new bridge regressions failed on the parent implementation.
• The exact input length succeeds and one byte less raises interpretation_size on cold and warm paths. Tests cover plain files, in-memory documents, encrypted input and edits, synthesized appearances, repeated builds on one budget, and preservation of the cached bridge on refusal. An encrypted PDF renders at its exact input length, refuses after an edit, and renders again after undo.
• Oversize reservations and appends fail before consuming the requested capacity. The polled relocation path, allocator-sized overflow and the independent operation memory meter are covered.
• Full Python suite on Windows with the committed fixture bytes: 7,462 passed, 706 skipped. The existing working copy has CRLF conversions in generated PDF fixtures, so the suite used a clean archive of this head with the locked, rebuilt extension.
• python3 tools/check.py --locked rust, locked uv sync, Ruff lint and format, ty check, the API reference check and git diff --check passed.

Next: verify current-head CI and review threads, squash-merge, and verify main. The issue handoff records the branch, validation and next action.