Bound per-round work in growing-span searches with a resumable cap, not span math

Sizing each round of an expanding-window search (span x8 per round) from the density measured so far can't bound memory: a round sized from a sparse stretch can land on a dense burst. What worked: give the scanner a hard maxChanges, have it return stoppedAt (the last time it judged), and resume the next round from there, so a misjudged round costs one capped read. Also check RSS after the bulk load and before the walk; if it's over the bound, undo the load and retry the round 8x narrower, and never let the span grow past that width again (without that clamp it oscillated into the limit repeatedly). Forward resume counts changes strictly after stoppedAt and backward strictly before it, so nothing is skipped or double-counted.