[openapi-mcp S8] Existing-machinery fixes: truncation metadata + receipt-after-validation

[rickylabs]

Part of #1126

Scope

The two existing-machinery fixes the adversarial pass exposed (both are prerequisites for honest evidence, not new features):

1. S-13b — central truncation: truncation.ts slices arrays to 50 without updating sibling metadata and has no whole-result byte bound; recompute truncation metadata after any cap the central pass applies and enforce a result-level byte bound.
2. S-15 — receipt ordering: withReceipt commits success when the flow returns, before the runner validates output (mcp-server.ts:96-112), and a throwing flow leaves prior green receipts standing. Move receipt commit after output validation; record thrown/validation failures as failed attempts so a stale receipt cannot masquerade as the new run.

S10 (evidence-gate acceptance) is explicitly blocked on this issue — see its body for why.

Design source: RFC #1123 (rfc.md §4 Wave 1) + adversarial-sol.md S-13/S-15.

Acceptance

• gate: fixture — a flow returning invalid output leaves a failed (not green) receipt
• gate: fixture — a flow returning 75 rows cannot reach the client as 50 rows with truncated: false