docs(code-runtime-python): drop forward references this layer does not own

Two comments described facts that belong to later layers of the stack:

- The workspace-constraints whitelist comment described a bootstrap the host
  spawns by path. This layer's py/ holds only protocol.py, the wire-vocabulary
  mirror, and nothing here spawns it. State what the whitelist entry actually
  covers: the Python source ships as-is rather than built.
- checkDoneValue's JSDoc claimed maxValueBytes "defaults to 32 KiB". This
  package defines no config and no default; maxValueBytes is a required boot
  frame field. Name it as the budget instead, so the prose cannot drift when
  the owning implementation picks a default.

Comment-only; the bound argument is unchanged.

packages/code-runtime/code-runtime-python/src/protocol.ts

@@ -392,8 +392,9 @@ function jsonStringBytesUpTo(text: string, maxBytes: number): number | undefined
  * not the parse that produced `value`.
  * That upstream width is bounded separately, by the host-side cap on inbound
  * fd-3 frame size before `JSON.parse` runs (owned by the runtime that reads the
- * channel), so `value` cannot be arbitrarily large when it reaches here, while
- * `maxValueBytes` defaults to 32 KiB. The traversal rejects over-budget BEFORE
+ * channel), so `value` cannot be arbitrarily large when it reaches here. The
+ * budget is the `maxValueBytes` the boot frame carries — a required wire field
+ * with no default at this layer. The traversal rejects over-budget BEFORE
  * materializing a string's escaped form or enqueuing an array's/object's
  * children, so a forgery within that frame cap cannot force those secondary
  * allocations. Object key COUNTING is