fix(llm): honor output ceiling in both passes

[ggrace519]

Summary

• forward the resolved max_output_tokens ceiling to both pass-1 and pass-2 LLM requests
• document that the CLI flag and environment setting apply per response without changing input admission
• make synthetic provenance-test commits independent of global GPG-signing configuration

The pass-1 omission caused large repositories such as n8n to stop at the hard-coded 128000-token default even when --max-output-tokens 262000 or GRAPHLM_MAX_OUTPUT_TOKENS=262000 was supplied.

Closes #73
Closes #74

Verification

• .venv/bin/pytest -q — 789 passed, 8 skipped, 2 collection warnings
• .venv/bin/mypy graphlm --ignore-missing-imports — success across 31 source files
• real n8n scan path with the LLM boundary instrumented — both requests received [262000, 262000] (previously [128000, 262000])
• independent fresh-context review — APPROVE, no findings
• git diff --check origin/main...HEAD — clean

Post-merge

Publish in the next patch release so installed 0.4.1 users can receive the fix with graphlm --upgrade.

🤖 Generated with Codex