[skygunner]

Host timing input JSON is byte-bounded, but its nesting limit currently depends on whether the Python decoder raises a recursion error. A valid document with 129 levels is accepted by _read_bounded_json, despite the bounded-input contract.

Add an iterative depth check with an inclusive limit of 128 after decoding. Keep the existing 64 KiB read limit and static invalid input JSON error. Regression subtests cover arrays and objects at depths 128 (accepted) and 129 (rejected).

Validation on Python 3.14.8, based on upstream 7cf6442f:

• The new depth-129 subtests fail on unchanged upstream and pass with the fix.
• python3 -m unittest scripts.tests.test_host_timing_dogfood: 14 passed on exact head 4454a138.
• git diff --check: passed.

This change touches only the timing-report parser and its tests.

[yyjeqhc]

Reviewed the iterative 128-depth bound, the inclusive array/object boundary cases, and error/size behavior. The patch is focused; CI and the diff check are green.