[rendro]

Summary

• Consolidation merge data loss: Abort merge if supersedes edge creation fails — without lineage, deleted content is irrecoverable
• Stdin drain DoS: Cap drain loop at 100MB to prevent indefinite blocking from malicious input without newlines
• Non-atomic delete ordering: Delete item first, then chunks best-effort. Orphaned chunks are benign (found only via item_id join); an is_chunked=true item with no chunks produces incorrect results
• Multi-byte panic in chunker: Snap overlap fallback offset forward past UTF-8 continuation bytes to prevent text[pos..] panic on CJK/emoji content

Test plan

• All 77 tests pass
• cargo clippy -- -D warnings clean
• cargo fmt --check clean