Stop the BON8 writer overflowing the stack on deep values

[nlohmann]

to_bon8() recursed once per nesting level. The BON8 reader does not recurse, so it accepts deeply nested input, for example about 24,000 nested one-element arrays. Writing that value back out then overflowed the stack. OSS-Fuzz 572238015 (parse_bon8_fuzzer) found this.

#5781 already bounded the CBOR, MessagePack and UBJSON/BJData writers. BON8 (#2998) was merged before it and was not covered. This PR applies the same approach to BON8:

• write_bon8_value takes a depth. Once depth reaches recursion_depth_limit(), it passes the rest of the value to write_bon8_iterative.
• write_bon8_iterative and write_bon8_value_or_push keep the open containers on a heap stack, reusing binary_container_frame. When they leave a container with more than four elements, they write the 0xFE closer.
• The output does not change: byte-exact tests check depths around the bound.

Tests in unit-large_json.cpp: BON8 now joins the round-trip, meet-at-the-bound, byte-exact, deep-object and 100000-deep sections. New sections cover:

• containers wider than four elements (0xFE closers, adjacent strings) past the bound;
• discarded values past the bound (BON8 still writes nothing for them, as on the recursive path);
• type_error.316 and out_of_range.407 thrown from below the bound;
• the OSS-Fuzz regression itself.

The bug was in no release. It existed only on develop from #2998 (merged 2026-09-27) until this PR.

Breaking changes to the public API

None. Only private members of detail::binary_writer changed.

Written by Claude Code.

🤖 Generated with Claude Code