core(message): Msg model + size-tripwire derive (#114)

[joeldsouzax]

Card #114. Adds the Msg marker trait (bombay-core) carrying a per-slot byte
budget (default 256 B), and #[derive(Msg)] (bombay_macros) which emits the
impl Msg plus a compile-time static-assert that trips when size_of of the
message exceeds its budget — making the mailbox's by-value slot-size discipline a
real compile error instead of a silence-able clippy lint. #[msg(budget = N)]
overrides the budget; generics and unions are rejected with spanned errors.

Scope per the card's finalized closed-enum model: handle stays with #116, the
reply port with #115. Does not touch Mailboxed (arbitrary type Msg still
compiles). Path is ::bombay_core (spine not yet behind the umbrella).

Tested: native runtime tests (generated impl + override), parse_budget unit
tests (present/absent/non-integer/bare/unknown-key, plus duplicate/negative/
overflow rejection), direct syn::parse_str::<DeriveMsg> guard tests for
generic/union rejection, and paired compile_fail doctests (tripwire fires,
boxing fixes it, budget escape, generic/union rejection). Coverage recorded in
docs/testing/coverage-baseline.md; the Msg trait's default const is pinned by a
unit test (cargo-mutants mutates function bodies only, so it yields no signal for
a trait-const-only module).

Design: docs/superpowers/specs/2026-07-05-msg-model-size-tripwire-design.md