fix: bound HTTP task request and response bodies

[RobLe3]

Summary

• enforce the protocol's finite HTTP task request and response limit before and during I/O
• reject unsupported encodings and malformed framing with structured non-retryable errors
• keep provider admission, success metrics, and receipts behind successful bounded parsing/serialization
• consume the shared protocol boundary fixture

Validation

• component quality runner across supported Python lanes
• 1,254 tests passed per completed supported lane; 2 deliberate skips
• Ruff and targeted MyPy checks pass

Implements the Python portion of RobLe3/IICP#250. No package publication or deployment.