fix(yaml): scale the scalar-byte budget for machine-written reports

from_report_str scaled node and event limits with input length but left
max_total_scalar_bytes at serde-saphyr's 64 MiB default, so a report
with more than 64 MiB of string content (reachable via the a2ml bundle
loader, which reads whole files) would still be rejected. Scale it the
same way; alias limits stay at their defaults.

Addresses CodeRabbit review on #234.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PFaqv6iBXrt3W5Akd1Fq5k

Author: claude

src/yaml.rs

@@ -6,8 +6,8 @@
 //! `serde-saphyr` enforces resource budgets while parsing. Its defaults
 //! suit hand-written configs (attack profiles, timelines, mutation specs),
 //! but its 250k-node cap rejects YAML reports from large scans (roughly
-//! 15k files). Machine-written reports therefore get a node and event
-//! budget proportional to the input length instead: an alias-free document
+//! 15k files). Machine-written reports therefore get node, event and
+//! scalar-byte budgets proportional to the input length instead: an alias-free document
 //! cannot have more nodes than bytes, so the cap still bounds alias
 //! expansion while accepting any report the caller's read limit allows.
 
@@ -27,6 +27,7 @@ pub fn from_report_str<T: DeserializeOwned>(input: &str) -> Result<T, serde_saph
     let mut budget = Budget::default();
     budget.max_nodes = defaults.max_nodes.max(input.len());
     budget.max_events = defaults.max_events.max(input.len());
+    budget.max_total_scalar_bytes = defaults.max_total_scalar_bytes.max(input.len());
     let mut options = Options::default();
     options.budget = Some(budget);
     serde_saphyr::from_str_with_options(input, options)