fix(interpreter): budget pending array expansions - #2670

What changed

Indexed/assoc array literals with duplicate subscripts now charge every pending element value against the live-intermediate byte budget, not just the values that survive. The expansion pass also holds the budget as leases instead of materializing duplicate copies, so transient memory stays bounded by the configured limit.

Why

Finding [SECURITY-ARRAY-PREEXPANSION-MEMORY]: a literal such as a=([0]= \$big [0]= \$big ...) (2000 dups x 1MB = ~2GB pending) bypassed the byte cap because the committer charged only the final surviving value. The in-memory peak scaled with the number of duplicate entries, an unauthenticated memory-exhaustion vector for any service executing scripts under a memory limit.

Before / After

Before (vulnerable code, budget check on final values only): 2GB transient allocation succeeds under a 10MB budget.

After (fixed): the same shape fails fast with a memory-limit error and the shell stays usable:

• indexed_array_pending_values_share_live_byte_limit: dup-subscript literal exhausts the live-byte limit -> error, shell usable afterward
• assoc_array_pending_values_share_live_byte_limit: assoc dup-key literal with distinct live entries -> error, shell usable afterward
• assoc_array_duplicate_keys_share_live_byte_limit: dup assoc keys charged per occurrence
• 7 new unit tests in limits.rs / interpreter/tests.rs cover small-literal fast path, dup-subscript commit charging, lease reuse, exhaustion errors, live-usage accounting

E2E smoke (hardened profile, 8KB value x 1200 dup subscripts = ~9.6MB pending vs 8MB limit): shell prints the memory-limit error and exits 1 instead of ballooning.

Risk

• Low. Changes only the array-literal code path; non-duplicate literals take the same fast path as before (verified by unit test). Full just test slice run in CI.
• What can break: scripts relying on over-budget duplicate-heavy literals succeeding would now get a memory-limit error -- that is the intended fix.

Checklist

• Tests added or updated
• Backward compatibility considered (internal code, no compat needed; over-budget literals erroring is intended)

Produced by yolop