fix(parser): bound tree-sitter scan resources

[alxxjohn]

Motivation

• The repo-configurable tree-sitter parsing path could be enabled from untrusted repository config and allowed per-file and concurrent parsing to consume large amounts of heap, creating a CI-facing denial-of-service vector.
• The runner previously cached parsed SyntaxTree values for the lifetime of a scan without any aggregate budget, permitting memory accumulation across many parsed script files.

Description

• Added aggregate accounting fields to fileCorpus (scriptBytes, scriptCount) and a scriptParse channel to serialize parser invocations in internal/codeguard/runner/support/corpus.go.
• Introduced maxTreeSitterScanBytes (256 KiB) and maxTreeSitterScanFiles (64) constants and enforce both limits in fileCorpus.parseScript; when exceeded the function returns an error so callers use the existing regex fallback.
• Serialization via a buffered channel prevents concurrent tree-sitter parses from amplifying transient heap usage.
• Added regression tests in internal/codeguard/runner/support/corpus_script_test.go to verify both the byte-budget and file-count budget behaviors and ensure caching semantics remain correct.

Testing

• Ran go test ./internal/codeguard/runner/support ./internal/codeguard/checks/support and the packages passed.
• Ran go test ./... and the test suite completed successfully.
• Ran gofmt -w on modified files and git diff --check to ensure formatting and no whitespace errors.

---

Codex Task