feat: data_diff row-count ceiling (max_rows guard)

## What does this PR do?
Add an optional `max_rows` guardrail to `data_diff` so a bad key selection can't inadvertently scan billion-row tables with `joindiff`.

## Why
Flagged during the v0.6.0 release review (CTO persona). A user could diff two 10B-row tables with `algorithm: 'joindiff'` and consume significant warehouse compute. `hashdiff` already bisects but the tool description doesn't enforce a ceiling.

## Proposed
- New tool param `max_rows` (optional, no default — preserves current behavior)
- When set, tool queries row counts first (fast via `information_schema`) and short-circuits with an error if either side exceeds `max_rows`
- Error message suggests partition_column / where_clause / hashdiff alternatives

## Deferred from
v0.6.0 release review. Filed at tag time per no-follow-up-PRs release policy.

## Type of change
- [x] New feature