fix: harden Q frame handling

[belowzeroff]

Summary

• return Q errors for malformed server frames instead of identity replies
• reject invalid compressed backrefs and oversized client response bodies
• fix QHOME detection and add malformed-frame regression coverage

Tests

• PATH=/Library/Developer/CommandLineTools/usr/bin:$PATH make lint
• git diff --check
• bash -n test/run.sh
• cc -std=c17 -Wall -Wextra -I. -Itest/tmp/rayforce-c/include -Itest/tmp/rayforce-c/src -fsyntax-only q.c q_server.c embed/rayforce_q.c test/driver.c
• make test RAYFORCE_LOCAL_PATH=/private/tmp/rayforce-q-origin/test/tmp/rayforce-c
• make test RAYFORCE_LOCAL_PATH=/private/tmp/rayforce-q-origin/test/tmp/rayforce-c CC='cc -fsanitize=address,undefined -fno-omit-frame-pointer'

Note: shellcheck is not installed locally.