Handle oversized Bake error-report stack paths safely

Context

The pinned Bun Bake corpus at 4982b91e3702094330f3be3883354c52b8c01323 includes an error-report hardening regression in test/bake/dev/html.test.ts. A browser can submit absolute stack-frame paths larger than the platform path buffer to POST /_bun/report_error.

Home reproduced the pre-fix failure: DevServer.relativePath attempted to normalize a 16 KiB path into bun.PathBuffer, panicked at index 1024 on macOS, reset the request, and terminated the development server.

Scope

• Port Bun's DevServer.relativePath size boundary without weakening the upstream payload or assertion.
• Preserve ordinary project-relative stack-frame rewriting.
• Return a successful error-report response and keep serving requests after an oversized absolute frame.
• Cover the behavior in Home's maintained Bake development gate and the unchanged pinned Bun test.

Acceptance criteria

• The unchanged pinned error report endpoint handles stack frames with very long absolute paths test passes through Home's native VM.
• The complete pinned bake/dev/html.test.ts file passes.
• zig build test-bake-development -Denable_jsc=true -j1 exercises the oversized report and remains green.
• Runtime and JSC build gates remain green.

Child of #555. Tracked by #66.

Fixed and pushed to main in 72e92110c7f81fe4c0e04f495e41ae72e0eeba67 (fix(runtime): bound Bake error report paths).

Root cause: POST /_bun/report_error accepted a 16 KiB absolute stack-frame path, then Home's DevServer.relativePath normalized it into the platform bun.PathBuffer (1,024 bytes on this macOS Zig toolchain). That panicked at index 1024, reset the request, and killed the development server.

The fix ports Bun's pinned hardening boundary: paths whose normalization workspace cannot fit are retained as submitted instead of entering fixed-buffer normalization. Ordinary project paths still become relative. Home's maintained Bake-development gate now posts the same two-frame binary payload, checks that the legitimate client.ts frame remains in the reply, and verifies the server still serves HTML afterward.

Verified against pinned Bun 4982b91e3702094330f3be3883354c52b8c01323 without changing its test:

• targeted bake/dev/html.test.ts regression: 1 passed, 0 failed, 4 assertions;
• complete bake/dev/html.test.ts: 8 passed, 0 failed, 29 assertions;
• 12-file retained Bake checkpoint: 84 parent tests passed, 1 upstream todo, 0 failed, 249 parent assertions, plus deinitialization's 9/9 child tests and 32 assertions;
• Home runtime (home_rt): 1,808 passed, 19 skipped, 0 failed;
• named Bake production and development gates: passed;
• JSC-disabled and JSC-enabled debug builds: passed;
• targeted Pickier, Python compile, and git diff --check: passed;
• vendored Bake tree: 43/43 files, no missing, extra, or mismatched files.

The all-package zig build test umbrella remains independently red in two ts_conformance baseline-selection tests; this checkpoint does not claim that unrelated umbrella is green.