v2/v3: host-side cumulative semantic-doc ceiling (stored-DoS guard)

Deferred from V1 by explicit ruling (2026-08-28): V1 ships with **no host-side cumulative semantic-doc ceiling**.

## Problem / Goal

Per-frame admission checks in the applier validate each op individually, but a stream of individually-legal ops can grow the doc past follower render capacity (stored-DoS). V1 intentionally ships without a cumulative ceiling; this issue tracks adding one in v2/v3.

## Proposed Solution

When picked up:
- decide enforcement point (applier admission-check cumulative ceiling vs cloud host doc-size watermark vs none reaffirmed)
- define the ceiling metric (node count, op count, serialized doc bytes) and rejection/backpressure semantics
- update conflict matrix + schema if rejection becomes a wire-visible effect

## Acceptance Criteria

- enforcement point + metric decided and documented
- ceiling enforced with tests covering a legal-per-frame stream that would exceed follower capacity
- conflict-matrix/schema updated if wire-visible

Full context for agent readers

Ruling source: blocked-on-christian issue #12 (DQ-21), option (c) — no host ceiling in V1, follow-ups filed in GitHub + Linear + bottom of todo. Cross-refs: in-app-agent-program `program/decision-queue.md` DQ-21 resolved row; todo `enact-6`.

Start with the applier’s per-frame admission checks, then read program/decision-queue.md DQ-21 and todo enact-6 for the V1 ruling. Decide the enforcement point, ceiling metric, and rejection or backpressure semantics; update the conflict matrix and schema if the result is wire-visible, and add tests for a legal-per-frame stream that exceeds follower capacity.

Written by the indexing model from the issue text.