fix: reject oversized payloads at LIN publish paths; correct E2E manual

[SoundMatt]

Summary

SAFETY_MANUAL.md documented the canonical ASIL-B E2E-protected publish
pattern as Protector::protect() output fed directly into
Bus::do_publish()/slave::Node::set_response(). protect() always
prepends a fixed kHeaderSize (10) byte header, which already exceeds
kLINMaxDataLen (8) for any payload, including a zero-byte one — so the
documented pattern can never actually fit in a single LIN frame. None of
the real publish paths validated payload length at all, so this silently
produced out-of-spec frames instead of failing loudly.

• Bus::do_publish() now rejects any non-empty payload longer than
  kLINMaxDataLen with ErrInvalidFrame (an empty payload keeps its
  existing "unregister this ID" meaning). slave::Node::set_response()
  delegates to do_publish() and is covered transitively.
• The RELAY adapter's LinAdapter::send() translates that same condition to
  ErrPayloadTooLarge — relay::INode::send()'s documented contract
  (spec §10.1) only allows ErrClosed/ErrNotConnected/ErrTimeout/
  ErrPayloadTooLarge, so it can't just forward IBus's
  lin::Errc::invalid_frame raw (mirrors the existing precedent for
  invalid-ID handling right above it).
• SAFETY_MANUAL.md §4.2 no longer presents the broken pattern as usable.
  It states the real numeric constraint, explains why no payload size makes
  it fit, and documents that Protector/Receiver are for use over a
  transport that can carry more than 8 bytes per logical message (e.g. a
  future multi-frame LIN diagnostic transport — not yet implemented, see
  ROADMAP.md) rather than direct single-frame publish, with a corrected
  example that never calls Bus::publish()/set_response() on protected
  output.

Closes #17

Test plan

• ctest — 175/175 pass (4 new regression tests across
  test_virtual.cpp, test_slave.cpp, test_relay_adapter.cpp)
• ASan+UBSan build — 175/175 pass
• relay conform --strict / relay interop --protocol LIN — both PASS