fix(pr): bound pagination allocations before growth - #2694

What changed

pr refuses pagination growth before exceeding its 16 MiB cap or shared live-memory budget. Headers append directly; cells and page slices borrow existing storage. Input, row and pagination loops charge work and check cancellation/deadlines, including skipped pages. Resource-limit failures leave the session reusable.

Date headers are retained as timestamps and formatted for one nonempty stream at a time, preventing eager duplication across inputs.

Numbered joined columns now expand number separators at local tab stops, preserving GNU pr output in the finite compatibility corpus.

Why

A long header repeated across short pages bypassed body-row accounting. The final output check ran only after building the amplified output, so an untrusted script could exhaust the embedding process.

Before / After

• Before: the matching 1 KiB header / 256-empty-line request with a 128 KiB live budget peaked at 1,347,052 bytes and failed the allocator bound. A separate bounded Bash::exec regression produced 268,436 bytes despite a 64 KiB live budget.
• After: the same request with a 128 KiB live budget returns a resource-limit error; measured peak heap growth is 173,400 bytes, including transient reallocations and interpreter dispatch. A subsequent execution succeeds.
• Empty-file date headers: 256 file operands with a 4 KiB -D format peaked at 1,313,620 bytes before; 258,964 bytes after, with the same 128 KiB live budget and empty output.
• The exact 16 MiB append boundary, UTF-8 rejection without growth, multi-file shared cap, ordinary/merge/form-feed/double-space/offset/page-selection modes and GNU comparisons pass.
• The earlier nested-substitution stack gate reproduces on clean main 508967f5; upstream fix(security): bound tar lists and nested substitution parsing #2678 fixes it. The rebased branch passes the existing depth-50, hard-cap, recovery and Bash comparison tests without raising stacks or weakening assertions.

Risk

Medium: oversized or budget-exhausting pr requests now return an API resource-limit error during rendering instead of a late builtin exit status. Ordinary pagination remains GNU-compatible in the tested cases.

Checklist

• Tests added or updated
• Backward compatibility considered

Validation: full just pre-pr, all-features Clippy, feature-sliced tests, security properties, dependency checks, CLI smoke, builtin inventory regeneration and performance suites (Criterion quick-mode smoke; no statistical regression claim). CI must finish green before merge.