Bound the workflow-artifact rate limiter's per-run map

[TheGreatAxios]

Summary

createRunCreateRateLimiter (in packages/artifacts-hub/src/workflow-routes.ts) backs the sliding-window rate limit on POST / and POST /binary in the workflow-artifacts routes. It closed over a plain Map<string, number[]> keyed by workflow run id, created once per hub process, with no eviction — every finished run's entry stayed resident for the rest of the process's uptime (CL-7243).

• Routes the map through @corbits/collections' createExpiringMap (CL-7233), with ttlMs: RATE_WINDOW_MS (the rate limiter's own 60s window).
• Why this TTL is safe: every allow() call sets the entry, refreshing its expiry, so an entry only lapses after a full window with no calls for that run. By the time an entry could expire, every timestamp it held is already older than RATE_WINDOW_MS and would already have been filtered out of recent by the existing cutoff check — the two boundaries coincide exactly, so eviction never removes a timestamp the sliding window would otherwise still be counting. A shorter TTL could drop a still-in-window timestamp early and reset a caller's quota; this one can't.
• Exported createRunCreateRateLimiter, RATE_WINDOW_MS, and MAX_CREATES_PER_RUN_PER_MINUTE for direct unit testing, plus an injectable now() (mirroring createExpiringMap's own hook) and a trackedRunCount getter so a test can assert on map size without a real clock.

Test plan

• New test: many distinct run ids age out after RATE_WINDOW_MS of inactivity, map size returns to a small bound.
• New test: a single run cannot exceed its per-window quota across the exact TTL boundary (eviction can't be exploited to reset the count early).
• New test: one continuously-active run stays tracked while a burst of one-shot idle runs around it get reclaimed.
• bun run typecheck
• HUB_DATA_DIR=$(mktemp -d) bun test packages/artifacts-hub — 69 pass, 0 fail
• bun run check:structural — all checks pass except check:report-error, which is already red on main and unrelated to this change
• bunx prettier --check . — clean