Make attachment APIs stream-only and bound all byte collection

[flyingrobots]

Plan: https://github.com/git-stunts/git-warp/blob/plan/streaming-recursive-materialization/docs/plans/streaming-indexed-recursive-warp.md
Design PR: #813

Problem

Node and edge content APIs can collect complete assets into Uint8Array, while large binary values can also enter through inline PropValue. The git-cas asset boundary is streaming, but eager callers discard that safety and can exhaust memory for videos or other large attachments.

Outcome

• Public and internal attachment APIs return handles, metadata, or streams.
• Remove eager complete-content methods from the v20 surface.
• Require an explicit maximum for any convenience collector outside the core API.
• Reject large inline binary values and direct callers to asset handles.
• Audit every production collectAsyncIterable() at asset, attachment, storage, proof, and migration boundaries.
• Preserve backpressure, cancellation, declared size validation, and streaming encryption frames.

Acceptance

• No public attachment method returns an entire arbitrary payload.
• No unbounded asset-to-buffer collection remains in production.
• A generated multi-gigabyte attachment drains under a small heap cap.
• A deliberately eager control fails under the same cap.
• Size mismatch, truncation, and overflow fail before excess allocation.
• Existing Retire legacy content attachment storage-plane boundaries #646 and Replace raw blob/tree ports with git-cas asset and bundle handles #737 are closed or narrowed with proof.

[coderabbitai]

🔗 Related PRs

#68 - fix: throw on missing content blob oids [merged]
#72 - feat!: mandatory CAS blob storage with streaming I/O (OG-014) [merged]
#749 - refactor(storage): delegate immutable payloads to git-cas [merged]
#751 - feat(materialize): add retained CAS materialization handles [merged]
#813 - Define streaming indexed recursive WARP architecture [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!