v0.1.16

release: v0.1.16 cap managed output limits, fix README managed-mode docs

- Clamp caller-supplied maxLength/maxBytes to a configurable absolute
  ceiling (AB_MAX_OUTPUT_LIMIT, default 5 MB) so a managed-mode tenant
  can no longer request an unbounded response (e.g. usize::MAX) and
  degrade the shared process for other tenants.
- Fix README overstatement that managed mode keeps secrets "out of
  browser-rs entirely" (values still transit browser-rs memory; only
  the credential database/lookup logic stays external).
- Fix managed-mode setup instructions: AB_SPAWN_NONCE is required
  alongside AB_MANAGED/AB_HTTP_CAPABILITY, the secret broker pair is
  optional, and a stray '+' broke the sentence in Markdown.
- Replace inaccurate "unset any var to return to standalone" claim
  with the actual per-variable startup/interaction semantics.
- Bump workspace version to 0.1.16.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>