Bound session replay responses

[posix4e]

Summary

• cap session replay history to 32 KiB so the base64 JSON reply stays under the Noise transport frame limit
• forward optional max_bytes from shell.replay_session through the Noise gateway
• return a truncated flag when replay history is clipped

Validation

• cargo fmt
• git diff --check
• cargo check currently fails on this Mac due existing macOS PTY openpty/ioctl type errors in src/sessiond.rs, unrelated to this replay change

[github-actions]

DD preview ready

URL: https://pr-264.devopsdefender.com

Browser login: visit https://pr-264.devopsdefender.com — DD redirects you to
the GitHub App auth broker. A DD session cookie scoped
to .devopsdefender.com lets the preview, fleet, and
shell hosts share the same login.

Machine-to-machine: GitHub Actions workflows in the
DD_OWNER org pass their per-job OIDC JWT as
Authorization: Bearer … (audience dd-agent).

Register endpoint for a local agent: https://pr-264.devopsdefender.com/register
(authenticated by ITA attestation).