Address review: make the object budget per fetch, not cumulative

Bugbot found that boundedStorer charged every RawObjectWriter call against one running total, while the store outlives a single fetch. The materialized strategy refills tag objects into the same store the closure was fetched into, and does so with nil haves — so the source resends objects already present, and those writes consumed budget a second time. A run whose distinct object count sat comfortably under --materialized-max-objects could therefore fail with ErrObjectLimit.

The cap now applies per fetch: FetchToStore resets it before streaming, via an ObjectBudget interface the store opts into, so no caller has to remember. Counting distinct objects instead would need the object hash, which RawObjectWriter does not have until the content has been written, and would mean keeping a set of every hash seen — more machinery than the guard warrants.

The honest consequence is that worst-case residency becomes the limit times the number of fetches, which is two on the sync path. That is still bounded, which the original ordering was not, and it avoids failing runs that are within the limit. Both the code comment and the changelog say so rather than implying a cumulative guarantee.