YamlGuard: unbounded nesting depth crashes the verifier with an uncatchable stack overflow #476

Round-3 lab (bb-exhaustion), major. A deeply nested YAML manifest (flow-mapping depth in the thousands) crashes the verification entry point with a .NET stack overflow — process exit 139 / SIGSEGV, which cannot be caught, so the fail-closed contract ("hostile input produces a rejection with a reason, never a hang, an exponential blowup, or an unhandled exception") is violated at the one input class the guard exists for. The 1 MB size cap does not help: a deeply nested document is tiny.

Note the guard already refuses anchors/aliases (billion-laughs) and now duplicate keys, both textual/streaming checks — a depth cap belongs in the same place (YamlGuard.Check), counted over the event stream (MappingStart/SequenceStart depth) or by a cheap textual scan, refusing beyond a sane limit (e.g. 64) before the deserializer recurses.