#3341 fix(crafter): bound AccessChk memory use during policy evaluation

Summary

The SYSINTERNALS_ACCESSCHK material type could drive the CLI to very high peak memory during client-side policy evaluation, risking an OOM kill of the CI runner for large materials. This bounds that memory use.

• Stream the AccessChk parser line by line instead of building a normalized full-text copy and splitting all lines at once, and stop pinning the whole input in memory via stored substrings.
• Size-gate the verbatim raw-text fallback fields (raw and per-object raw_lines): retain them for inputs below a threshold and omit them above it, keeping the JSON projection handed to the policy engine from ballooning to multiples of the original file size. These fields are not attested and are unused by current policies, so recorded evidence and evaluations are unchanged.
• Make AccessChk output detection independent of the raw field so oversized descriptor-only materials are still recognized.
• Warn at craft time when a material exceeds the retention threshold.

Closes PFM-6922.

AI assistance

This change was produced with the assistance of Claude Code.