Bound PowerFactory contingency element scans

[aswinkrishnapoyil]

Summary

• Add a termination ceiling to the affected-element walk in get_contingency_summary.
• Raise a clear error if PowerFactory does not return None within 10,000 elements.
• Preserve the existing bounded output and truncation metadata.
• Add regression coverage for a GetObject() implementation that never signals the end.

This prevents the single PowerFactory worker from becoming stuck in an unbounded loop.

Validation

• PowerFactory suite: 40 passed, including 7 subtests.
• git diff --check passed.

Closes #87

[qian-harvard]

This does what #87 asked for: the walk now always terminates, a runaway GetObject surfaces as a structured {success: false} with Release() still running, and total_affected_elements can never be a capped number because every path that reaches the cap raises. Reviewed from four angles, with each finding independently reproduced; nothing blocking.

I pushed one fix as c4ef140 (maintainer edit): an off-by-one at the boundary. for index in range(cap) with a for/else never probes index cap, so a contingency listing exactly 10,000 elements exhausted the loop without seeing the terminating None and was rejected as "exceeded" — a false error, where main accepts it. The walk now probes one index past the cap:

n=10000     ok, total=10000, 10001 probes
n=10001     "exceeded the safe limit", 10001 probes
never None  "exceeded the safe limit", 10001 probes

Tests: the boundary is pinned with the cap patched to the fixture's two elements, and there's an assertion that the cap stays above max_affected_elements' clamp of 1000 so truncation stays reachable. One change to your test: the never-None fake now counts its probes and raises after ten. Before, reverting to while True made the test hang rather than fail, and CI sets no pytest timeout — I checked by mutation that it now fails in milliseconds.

Merging. Thanks for turning #87 around within the hour.