fix: enforce bounded SELECT results

[marianfoo]

Summary

• reject explicit zero, invalid, overflowing, and above-maximum SELECT row limits before code generation
• normalize unsafe saved defaults and cap all multirow SELECT paths at 10,000 rows
• add parser and set-query regressions and remove the former unlimited-mode documentation

Root cause

ABAP treats a zero UP TO value as up to 2,147,483,647 rows on the supported releases. ZTOAD stripped the clause and reused initial fw_rows as an “omit the cap” sentinel in every generated SELECT path. A saved default of zero reached the same bypass.

TDD evidence

• Red candidate ccea897 on NPL: 113 tests, 112 passed; only LTC_QUERY_PARSER->REJECTS_ZERO_LIMIT failed
• Frozen source candidate: 832d057656dc2923e79b87eff5016b718dad42fe
• Source SHA-256: b8d5d7807e42832b105deabe4d55f142ee10408a4f1ef975cf9530d17cf2ebb4

Validation

• Local: npm ci, npm test, configured abaplint zero findings, repository/installation contracts, and git diff --check passed
• NPL / SAP_BASIS 750: active syntax clean; ABAP Unit 120/120; active/inactive state equal; zero inactive ZTOAD parts; DEFAULT ATC unchanged at 85; no new ST22 dump
• A4H / S/4HANA 2023: active syntax passed with the seven documented POSIX warnings; ABAP Unit 120/120; active/inactive state equal; zero inactive ZTOAD parts; Cloud ATC improved from 709 to 706 with no new finding signature
• Fresh WebGUI smoke: UP TO 0 ROWS was rejected before execution; a positive two-row limit returned exactly two rows; no new ST22 dump
• Both shared systems were restored to merged master and verified at 113/113 tests with zero inactive ZTOAD parts

The S/4HANA readiness variant showed zero displayed findings, but remains recorded as incomplete because prerequisite execution could not be proven.

Tracking: BASE-RUN-004.

[marianfoo]

Final post-green audit complete on head 24404eb16e0a50d58a3432e4d2f9721b1cbe31b9.

• Second Quality run 31196499583 is green.
• Required checks: Repository quality passed; abaplint passed; abaplint observations is neutral by design.
• The seven-file PR inventory matches the reviewed diff, with no unresolved review threads or comments.
• The audit corrected the stale unlimited-override checklist wording and added separate validation guidance for explicit versus persisted/default sentinel values.
• No src/ or serialized-object file changed after frozen source commit 832d057, so the recorded NPL/A4H evidence remains valid.
• PR is cleanly mergeable.