v0.3.0

prism-ai-core 0.3.0

BREAKING CHANGE: Media.fetch_public() now refuses an answer over 32 MiB
with media_too_large, where 0.2.0 accepted any size. If you fetch larger
media through the guarded path, pass max_bytes=... to raise the cap.

SECURITY (G-90): the guarded fetch takes a URL the caller does not
trust, and read its answer whole, so a public host could answer with
gigabytes and exhaust the worker's memory.

• HttpRequest.max_body_bytes (new, optional): a transport reads at most
  one byte past it, and nothing when a declared Content-Length is
  already over it. The default UrllibTransport honours it. A custom
  Transport should too; one that does not is still refused, after the
  read.
• fetch_public(max_bytes=32 * 1024 * 1024) sets it and refuses a body or
  a declared length over the cap. 32 MiB is the largest inline document
  the providers take, so a larger body could not be sent to a model
  anyway.