feat(setup): refuse an output_format_spec at or over 4096 characters

[Ekyoz]

Past that length the write still succeeds but the setup is unusable, and nothing in the failure points back at the field. Reject up front instead, naming the path and the actual size.

The rule lives in SetupContentValidator, beside reject_unsafe_keys, but it is not wired the same way. SetupContentValidator.validate reaches content only through the agno registry toolkit, where it is best-effort: a no-op when no ModuleContext is wired or the schema fetch fails, and CreateServiceAction never calls it at all — so a create would slip through. This check needs neither context nor a schema fetch, so it is called unconditionally from create_setup and update_setup on both DefaultSetup and GrpcSetup, the one choke point every write crosses.

On GrpcSetup it sits outside handle_grpc_errors so it stays a ValueError rather than being swallowed into SetupServiceError by the catch-all, and it raises before any RPC is issued.

The boundary is exclusive (4096 itself is refused) and the walk recurses through nested objects and arrays; non-string values are left to the schema check, which owns typing.

Carries a uv.lock refresh as a prerequisite: dev and main both pin agentic-mesh-protocol==1.0.1 in pyproject while locking 1.0.1.dev4, which lacks set_as_current, ListSetupVersionsRequest and SetCurrentSetupVersionRequest. mypy fails on the existing grpc_setup and grpc_storage code until the lock resolves to the real 1.0.1.