fix(quality): bound AI provenance git output

[alxxjohn]

Motivation

• Prevent unbounded memory usage when reading attacker-controlled git commit messages for AI provenance checks by limiting the amount of data read from git log while preserving the existing timeout.

Description

• Replace cmd.Output() buffering with a bounded limitedBuffer written to cmd.Stdout and run via cmd.Run() so stdout is capped at maxGitHeadMessageBytes (1 MiB) while keeping the two-minute context timeout.
• Treat oversized or failed commit-message reads as inactive provenance by returning an empty string from readGitHeadMessage, preserving existing behavior that skips provenance when no trailer is found.
• Add limitedBuffer type and associated error errGitHeadMessageTooLarge, and update imports to include bytes and errors.
• Add regression tests in internal/codeguard/checks/quality/quality_ai_resolution_test.go that verify the bounded buffer rejects oversized output and accepts output within the limit.

Testing

• Ran go test ./internal/codeguard/checks/quality/... and the coverage tests for the modified package succeeded.
• Ran go test ./... and it completed with no failures.
• Ran make lint-strict and git diff --check with no issues reported.

---

Codex Task