fix: validate bounded JSONRPC frames and envelopes (Fixes #532) - #560

PR classified as team-member.

✅ Head commit 3b2eec8 is signed by karthiknadig with trusted key 65CAC28268EDBD935D627BF34DC9FC7E9D93EA2A — approval requirement reduced from 2 to 1.

✅ Collaborator approvals: 1/1 (dmitrivMS).

✅ No newly added runnable binary files.

✅ No protected engineering system files changed.