fix(protocol): harden gateway contract validation

tools/test_generated_contracts.py

@@ -85,6 +85,25 @@ do {
     )
     fatalError("invalid allocation bounds were accepted")
 } catch { }
+for text in [
+    String(repeating: "a", count: 65536),
+    String(repeating: "é", count: 32768),
+    String(repeating: "\\\"", count: 32768),
+] {
+    let clipboard = try GatewayClipboardText(
+        direction: "client_to_provider", text: text, encoding: "utf-8",
+        loopToken: "abcdefghijklmnop"
+    )
+    let decoded = try GatewayClipboardText.decodeJSON(clipboard.encodeJSON())
+    guard decoded.text == text else { fatalError("clipboard text changed during round-trip") }
+}
+do {
+    _ = try GatewayClipboardText(
+        direction: "client_to_provider", text: String(repeating: "a", count: 65537),
+        encoding: "utf-8", loopToken: "abcdefghijklmnop"
+    )
+    fatalError("oversized clipboard text was accepted")
+} catch { }
 """,
             encoding="utf-8",
         )
@@ -130,6 +149,19 @@ fn main() {
     assert!(AllocationPolicy::new(
         100, 50, 25, "standard".into(), "audience".into(), "verse".into(), 1, 60, 300,
     ).is_err());
+    for text in [
+        "a".repeat(65536),
+        "é".repeat(32768),
+        "\\\"".repeat(32768),
+    ] {
+        assert!(GatewayClipboardText::new(
+            "client_to_provider".into(), text, "utf-8".into(), "abcdefghijklmnop".into(),
+        ).is_ok());
+    }
+    assert!(GatewayClipboardText::new(
+        "client_to_provider".into(), "a".repeat(65537), "utf-8".into(),
+        "abcdefghijklmnop".into(),
+    ).is_err());
 }
 """
             )