v1.0.1

Bounds every read by size as well as by time.

A marketplace review pointed out that the watchdogs added in 1.0.0 bound how long a command may
run, not how much it may return. StdioCollector holds a whole stream and offers no cap, and the
panel runs inside a shell process that outlives it, so a hostile response or a pathological config
file could exhaust the shell rather than the plugin.

• scripts/controld_api.py reads a bounded number of bytes and reports a body that exceeds it,
  for the error body as well as the answer.
• Every process the panel runs is piped through head -c under pipefail, so the command's own
  exit code still reaches the error handling and argv still passes positionally.
• The resolver probe caps each section as well as the whole, so one large file cannot crowd out
  the sections after it and hide the resolver that answers.

No behaviour change for anyone whose account and configuration are ordinary size.