3.8.1 — maxTokens no longer capped below real model ceilings

validateMaxTokens rejected anything above 100,000 client-side, so the SDK — not the model, not the gateway — was the binding constraint on every caller. Asking zai/glm-5.2 for the 262,144 it advertises threw instead of sending.

Probed the live gateway 2026-07-21 with the guard bypassed: 19 models advertise a ceiling above 100,000 and all 19 accepted it, including zai/glm-5.2 at 262,144 and the entire 128,000 class (claude-opus-4.8, claude-sonnet-5, claude-fable-5, gpt-5.6-sol/terra/luna, gpt-5.5, gpt-5.4, gpt-5.3-codex, glm-5/5.1/5-turbo). Zero rejections.

MAX_TOKENS_SANITY_LIMIT is now 1,000,000 and exported from the package entry, documented as a typo guard. The bound stays so a stray 1e9 fails locally rather than becoming a payment quote; it just must never be reachable by a real request.

The guard had no test coverage at all. New test/unit/validation-max-tokens.test.ts pins the real ceilings, the typo case, the full accepted range (so lowering the constant back can't pass silently), and — deliberately — that the message does not describe itself as a model limit, since that phrasing is what caused a downstream misreading.

216 pass, typecheck clean.