## Why
Checking notification data size after SSE parsing leaves oversized fields and unterminated frames free to accumulate in the parser. Malformed UTF-8 can also be retained indefinitely by the decoder.
## What changed
Enforce `MAX_BODY` on incoming frame bytes before SSE parsing and reject malformed UTF-8 incrementally. Reset the byte count at blank lines, supporting LF, CR, and CRLF across chunks, so the limit applies per frame rather than per connection. Stop reading the source stream after an error.
## Testing
Extend the remote board contract test to cover oversized readiness fields, unterminated fields, and multiline data frames. Verify that a long sequence of heartbeat frames with all three line endings still permits notification delivery.
GitOrigin-RevId: c3a95ead88f53e7acfb28c5ba23141bc11d25532
## What changed
Add `codex-agent-message-board-client` with a `RemoteAgentMessageBoard` implementation of the existing `AgentMessageBoard` interface over a versioned HTTP API. Use the shared HTTP client for authenticated board creation, deletion, member registration, and board operations.
Validate endpoints and credentials, bound request and response sizes, and support a caller-supplied clock. Allow post retries without a fresh timestamp so the service can replay an already committed result.
Provide live SSE receivers that wait for readiness and reject notifications for another agent or turn, as well as previews exceeding 150 characters.
## Testing
Add a mock HTTP integration test covering endpoint and returned-credential validation, bearer authentication, post retries when the clock is unavailable, Unicode post reads, SSE readiness and notification validation, and service error handling.
GitOrigin-RevId: 844f63ee14dc216a9d61767115892c4783fe9d44
jif