Closes #1102

Summary (program: GSSoC)

Large code graph results can exceed LLM context windows silently. This PR cuts payloads at a configurable limit, appends a visible notice, and logs a warning so nothing fails quietly.

What's New

• 🔒 Dual config knobs: Added MAX_PROMPT_CHARS alongside MAX_TOOL_RESPONSE_TOKENS. Whichever is stricter wins.
  To test: Set MAX_PROMPT_CHARS=500 and MAX_TOOL_RESPONSE_TOKENS=50 in CGC config, run a graph query with large output, and confirm truncation fires.

• ✂️ Truncation logic: Updated _apply_response_token_limit() to use _effective_char_limit() for the budget, cut at a clean JSON boundary, and append a [CGC] Response truncated notice to the payload.
  To test: Query a large codebase and look for the [CGC] Response truncated notice at the end of the response.

• 📢 Truncation warnings: Prints a [CGC WARNING] line to stderr on every truncation, with tool, original_chars, truncated_chars, and limit. No more silent failures.

• 🧪 Tests: Unit tests for _effective_char_limit, _limit_source_label, and the full _apply_response_token_limit flow: both knobs, stricter-wins, unlimited, at-limit, non-JSON, and warning emission.

Implementation

Feature Testing (Scenario) 👇

Testing Edge Cases 👇

Files Changed

• src/codegraphcontext/server.py (53 additions, 12 deletions): added _effective_char_limit() and _limit_source_label(); updated _apply_response_token_limit() to read both config knobs and emit a stderr warning on truncation.

• src/codegraphcontext/cli/config_manager.py (13 additions): registered MAX_PROMPT_CHARS with default value, config description, and non-negative integer validation.

• tests/unit/tools/test_prompt_truncation_safety.py (269 additions): new test file covering both config knobs, stricter-wins logic, at-limit/below-limit edge cases, non-JSON payloads, stderr warning emission, and MAX_PROMPT_CHARS config validation.

• tests/test_truncation_real_scenario.py (new): real-scenario integration test mirroring an actual CGC config state with realistic tool response payloads.

Edge cases covered

• Both knobs at zero → no truncation, text returned unchanged ✅
• Only one knob active → that knob is the limit ✅
• Both knobs active → stricter value wins ✅
• Non-JSON payload → character slice still applies ✅
• Payload at exactly the limit → no truncation fires ✅
• Invalid config value (non-integer) → silently defaults to 0, no crash ✅