Bound pending SSE writes under stalled consumers

[smiggleworth]

Summary

• cap unresolved SSE writes at highWaterMark before retaining payload closures
• defer serialization and encoding until the accepted write reaches stream capacity
• reject overflow immediately with stable QuotaExceededError
• release admission slots on every settlement path and skip heartbeats while full
• document the bounded producer contract and retry/await obligation

Linked issue

Closes #16

TDD

• Red c79c994: 100 unawaited calls formatted all 100 distinct 100 KB payloads synchronously against highWaterMark: 2.
• Green 09c07ed: only two calls are admitted/formatted, 98 settle immediately as QuotaExceededError, and draining admits queued work in order.

Guardrails

• deterministic many-unawaited/no-reader admission and serialization counts
• overflow error identity and no retained formatting
• drain/recovery ordering
• deferred serialization failure releases capacity
• stalled heartbeat coalescing
• existing framing, abort, closed-stream, and idempotent-close coverage

Acceptance audit

• Every acceptance criterion in SSE send()/comment() grow memory unboundedly with an unawaited producer against a stalled consumer #16 is checked with evidence.
• Focused red test failed for eager unbounded formatting and passes at green.
• Full unit, type, build, package-artifact, audit, and exact-head hosted CI gates pass.
• Exact squash merge, tag, publish workflow, and clean registry consumer are verified.

Verification

• npm run check
• npm audit --omit=dev

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[smiggleworth]

Release closure verified:

• squash merge 4fbf7453fae679c4428ae56bdcf7b4b1ed8559be
• publish workflow run 31906519837 passed all three CI lanes and the publish job at that exact SHA
• annotated tag v0.0.17 peels to the merge SHA
• npm serves @askrjs/server@0.0.17 with integrity sha512-X5zGyMr2n+EWqZktK7/pyBHW3rhU1bxj1jvfXH4HztEJOOcWyEY4ZutL/rBroNeh9lk+ABvR7MWZge2f+VvF5w==
• a clean registry consumer with highWaterMark: 1 admitted/formatted one of ten 100 KB events and immediately rejected nine as QuotaExceededError, with zero eager serialization
• clean consumer runtime audit reports zero vulnerabilities