fix(security): isolate template rendering with hard resource limits

docs/ADMIN_GUIDE.md

@@ -36,3 +36,21 @@ Apply the module Alembic migration before startup. Monitor rejected renders for
 contract drift, output limits, missing Files permission, and reused idempotency
 keys. HTML is designed for browser/OS printing; do not treat it as a signed PDF
 or proof of physical printer delivery.
+
+Pure rendering runs in a disposable Core worker after authorization, revision
+selection and idempotency lookup. Each worker has a 15-second wall limit,
+10 CPU seconds, 512 MiB address space and no file output. Typed input transport
+is limited to 32 MiB and result transport to 8 MiB, including serialization
+overhead; nesting is limited to 64 levels and 1,000,000 value nodes. The existing
+5 MiB final output and 5,000-item limits remain. Only data DTOs cross the
+boundary; principals, SQL sessions, credentials and artifact writes stay in the
+parent. Completed idempotent renders return before a worker is started.
+
+`GOVOPLAN_ISOLATED_PROCESS_CONCURRENCY` in Core controls active isolated work per
+API/worker process without queuing. Busy capacity produces a sanitized retryable
+render error. CPU, memory, transport or time failures stop the entire render
+before artifact persistence; reduce the workload before retrying. POSIX process
+resource controls are required. Missing controls, cancellation or worker failure
+fails closed with no in-process fallback. Budget aggregate memory across all
+slots and API/worker replicas; monitor limit and overload errors separately
+from template compatibility errors.