feat(webfetch): configurable max response size

[kvnloo]

Summary

Make WebFetch's response-size cap configurable while keeping 5 MiB as the default.

• webfetch.max_response_size accepts a positive integer in bytes
• OPENCODE_WEBFETCH_MAX_SIZE is the fallback when config is unset
• invalid environment values fall back to 5 MiB
• both Content-Length and actual buffered-body checks use the resolved limit

Credit / provenance

This carries forward the config design from upstream anomalyco#46812 / anomalyco#46799 by @RaviTharuma and the earlier environment-variable approach from anomalyco#36863 by @ulises-jeremias. This branch refreshes those ideas onto current dev and keeps the combined focused regression coverage.

Current refresh

• rebased cleanly onto current dev on 2026-10-03
• 0 commits behind
• only the ConfigV1 schema, WebFetch implementation, and focused WebFetch tests changed
• stale unrelated dependency / browser-opening changes were explicitly removed

Verification

The earlier focused downstream proof passed the WebFetch test file. Current upstream CI should revalidate this refreshed head.

github_writes_origin=0 — ready to promote when upstream write access is available.

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍