CHR-013 Untrusted Input Hardening Pass

[greysquirr3l]

Summary
Harden parsing and execution paths for untrusted data.

Priority: P1
Estimate: M
Acceptance Criteria:

• Input validation and limits are enforced
• Malformed input tests cover critical parsers
• Errors avoid panics and data leakage