Clamp session.list limit to avoid unbounded fetches

[aydnOktay]

The TUI gateway session.list RPC accepted unbounded and negative limit values, which could force oversized SQL fetches and cause Python negative-slice semantics to return nearly the full session list. This change clamps limit to a safe range of 1–500 while preserving the existing default of 200 for the resume picker.

[teknium1]

Thanks — this fixes a verified current-main defect in the TUI session-list RPC.

Suggested changes

• Consider a separate follow-up for spawn_tree.list: tui_gateway/methods_session.py:2858 accepts an unchecked limit and :2903 slices with it, preserving the negative-slice pattern. This is outside the scope of the present session.list change and is non-blocking.

session.list on current main passes its caller-controlled limit through to the SQL-backed list_sessions_rich fetch (tui_gateway/methods_session.py:178-192; hermes_state.py:5227). PR commit 48f561614bae bounds that value to 1–500 and adds regression coverage for excessive, negative, zero, and default inputs.

Automated hermes-sweeper review.

[aydnOktay]

Closing to concentrate review on a single linked product bug: #89979.

[aydnOktay]

Closing to concentrate review on a single linked product bug: #89979.