fix: CVE-2026-39414 harden S3 Select oversized record handling

Enforce the 1 MiB maxCharsPerRecord limit while splitting CSV and line-delimited JSON input so oversized records are rejected before they can be buffered and parsed.

Return OverMaxRecordSize for these failures instead of collapsing them into InternalError, and preserve splitter errors in the JSON worker so oversized-record failures are not lost after successful partial decode.

internal/s3select/select.go

@@ -658,6 +658,10 @@ OuterLoop:
 	}
 
 	if err != nil {
+		if serr, ok := err.(SelectError); ok && serr.ErrorCode() == "OverMaxRecordSize" {
+			_ = writer.FinishWithError(serr.ErrorCode(), serr.ErrorMessage())
+			return
+		}
 		_ = writer.FinishWithError("InternalError", err.Error())
 	}
 }