fix: bound wildcard edge expansion - #2926

Human

AI

Summary

• Bound distinct wildcard edge fanout and total endpoint-pair work, including selectors and repeated lazy expansion.
• Apply the limits consistently through the compiler, IR, and library APIs while leaving explicit edges proportional to source size.
• Preflight Dagre and ELK inputs for size, density, malformed endpoints, and cancellation before entering native layout calls that cannot be interrupted.

Security impact

Small wildcard edge expressions could expand into complete graphs or repeatedly replay endpoint matching, consuming excessive CPU and memory. Direct graph callers could also send oversized or highly interconnected inputs into non-cancellable Dagre and ELK calls. The compiler budgets and layout admission checks stop both paths before resource exhaustion.

Validation

• go test -count=1 ./...
• go vet ./...
• The 2,000-segment and 5,000-node selector reproducers reject in under 0.1 seconds.
• Dagre and ELK accept 1,024-object and 1,024-edge sparse boundaries and reject 1,025.
• Tests cover repeated lazy work, selector expansion, malformed raw edges, dense graphs, cancellation, and public option propagation.