[MGPipe] cut buffer content ranges at the stage segment's chunk budget

One resource_subdata record's blob is staged whole in SEG_STAGE, so a range
larger than that arena is Fatal{RingOverrun, SEG_STAGE} at the encoder rather
than a split: the CI traces abort there on a 128 MiB arena's whole-buffer
follow-up against a 32 MiB segment.

- ClientSession::StageCapacityBytes(), the twin of EventRingCapacityBytes, so
  the emitter can size against the arena the codec allocates from.
- MGPipeStageChunkBytes(): clamp(segment/4, 4096, segment), 0 when there is
  nothing to fit (monolith, the server role's own uploads, no session).
- PipeFill.cpp's two buffer content walks take that cap instead of the
  record's own 2^32-1 bound, so an over-long range becomes several contiguous
  ascending records. StagedShadowStore::Adopt already accumulates coverage.

ClientSession.h/.cpp, GpuWritePending.h/.cpp, PipeFill.cpp.

MobileGL/MG_Remote/Client/ClientSession.cpp

@@ -1467,6 +1467,8 @@ namespace MobileGL::MG_Remote::Client {
 
     Uint64 ClientSession::EventRingCapacityBytes() const { return m_shm.EventRingCapacity(); }
 
+    Uint64 ClientSession::StageCapacityBytes() const { return m_shm.StageBytes(); }
+
     Wire::SegmentTable& ClientSession::Segments() { return m_segments; }
 
     Transport::RingControl* ClientSession::Control() { return m_shm.CmdControl(); }