refactor(realism): enforce synthetic_files 64KB cap at the repo

The orchestrator worker clipped last_body at write time, but the repo
didn't enforce. A future caller that forgot the clip would write the
full body. Move the clip to record_synthetic_file and
update_synthetic_file via SYNTHETIC_FILE_BODY_LIMIT in
decnet/web/db/models/realism.py. Worker now passes the full body and
trusts the repo. Tests retargeted to assert repo enforcement.

decnet/orchestrator/worker.py

@@ -385,7 +385,7 @@ async def _bump_synthetic_file_after_edit(repo, action, result) -> None:
         patch["content_hash"] = hashlib.sha256(
             new_body.encode("utf-8"),
         ).hexdigest()
-        patch["last_body"] = new_body[:65536]
+        patch["last_body"] = new_body
     await repo.update_synthetic_file(action.synthetic_file_uuid, patch)
 
 
@@ -411,10 +411,7 @@ async def _record_synthetic_file(repo, action) -> None:
         "last_modified": now,
         "edit_count": 0,
         "content_hash": content_hash,
-        # Cap the persisted body — large blobs (DOCX/PDF/canary
-        # artifacts in stage 7) are wasted disk on this side; the
-        # decky filesystem holds the canonical bytes.
-        "last_body": body[:65536],
+        "last_body": body,
     }
     try:
         await repo.record_synthetic_file(row)
@@ -432,7 +429,7 @@ async def _record_synthetic_file(repo, action) -> None:
             {
                 "last_modified": now,
                 "content_hash": content_hash,
-                "last_body": body[:65536],
+                "last_body": body,
                 "edit_count": int(match.get("edit_count", 0)) + 1,
             },
         )

decnet/web/db/models/realism.py

@@ -22,6 +22,15 @@ from sqlalchemy import Column, Index, Text, UniqueConstraint
 from sqlmodel import Field, SQLModel
 
 
+SYNTHETIC_FILE_BODY_LIMIT = 65536
+"""Cap on persisted ``synthetic_files.last_body`` bytes.
+
+Enforced by the repo on both insert and update — callers may pass the
+full body; the repo clips. Large blobs (DOCX/PDF, canary artifacts) are
+wasted disk on the master side; the decky filesystem holds the canonical
+bytes."""
+
+
 class SyntheticFile(SQLModel, table=True):
     """One realism-planted file on one decky.
 

decnet/web/db/sqlmodel_repo.py

@@ -3335,6 +3335,9 @@ class SQLModelRepository(BaseRepository):
     # ------------------------------------------------------------ realism
 
     async def record_synthetic_file(self, data: dict[str, Any]) -> str:
+        from decnet.web.db.models.realism import SYNTHETIC_FILE_BODY_LIMIT
+        if "last_body" in data and data["last_body"] is not None:
+            data = {**data, "last_body": data["last_body"][:SYNTHETIC_FILE_BODY_LIMIT]}
         async with self._session() as session:
             row = SyntheticFile(**data)
             session.add(row)
@@ -3345,6 +3348,9 @@ class SQLModelRepository(BaseRepository):
     async def update_synthetic_file(
         self, row_uuid: str, data: dict[str, Any],
     ) -> None:
+        from decnet.web.db.models.realism import SYNTHETIC_FILE_BODY_LIMIT
+        if "last_body" in data and data["last_body"] is not None:
+            data = {**data, "last_body": data["last_body"][:SYNTHETIC_FILE_BODY_LIMIT]}
         async with self._session() as session:
             stmt = (
                 update(SyntheticFile)