Feature Request: Directory write guard (ENOSPC above max-dir-entries), streaming readdir, and documented limits — remaining scope from #4696

## Summary

Follow-up to #4696, which was closed as completed but is only partially addressed. #4736 (still open) implements just the warning-threshold log (feature #2), as a hidden experimental flag. This issue tracks the remaining, substantive scope from #4696.

## Remaining work

### 1. Write guard — block writes above a configurable entry limit
Reject `O_CREAT` on a directory at/above a configurable `max-dir-entries` with `ENOSPC`, plus a structured `WARNING` log. This is the corruption-prevention mechanism the original request centered on: read-path mitigations don't stop a directory from growing further into the degradation/corruption zone (~50k read degradation, 100k+ corruption risk). Returning `ENOSPC` ("no space left on device") gives applications a standard, actionable signal.

```yaml
file-system:
max-dir-entries: 50000 # block new creates + warn when the parent dir hits this
```

### 3. Streaming / incremental readdir
Stream `ListObjects` entries back to the kernel incrementally instead of buffering the full result, to cap peak memory and latency at 100k+ entries. (Larger change; likely its own PR.)

### 4. Documented limits
Publish a supported maximum directory size (entries per prefix) with mitigation guidance (subdirectory sharding, HNS buckets, etc.).

## Status
- Feature #2 (warning-threshold log): #4736 (open)
- Feature #1 (write guard): PR incoming (see below once opened)
- Features #3, #4: not started

Refs #4696, #4736.

Start by reading #4696 and the open #4736 to separate the remaining write-guard, streaming readdir, and documentation scope from already addressed work. Done means the configured write limit returns ENOSPC with a structured warning, directory listings stream incrementally, and supported limits plus mitigation guidance are documented; the issue names no files or tests.

Written by the indexing model from the issue text.