Preflight locked batch limits before trusted context lookup

[aruintelligence]

Problem

Locked HTTP batch requests reached the trusted context resolver before checking locked_policy.max_batch_items. An oversized request could spend resolver work and even return 503 trusted_context_unavailable instead of the documented batch ceiling response. With a healthy resolver it returned a different 400 error than the unlocked path.

Change

Preflight the server-owned batch ceiling before context resolution and audit ID allocation. Both locked and unlocked oversized batches now return 413 batch_limit_exceeded. The locked and unlocked ceilings remain independently configured.

Verification

A new regression failed before the change: an oversized locked batch invoked a throwing resolver and returned 503. It now returns 413 without calling that resolver; an in-limit request still reaches the resolver and fails closed. Focused HTTP/deployment tests (44/44), the full Node test suite, public contract, deployment surface, and link checks pass.

This removes unnecessary trusted callback work for invalid batches; it does not replace edge rate limits or authentication.