Wait for sanitized IaC map publication in the CLI

[maximelb]

A sanitized map push returns a receipt while the server publishes it in the background. The SDK exposes a scoped status read; the CLI polls until publication and resubmits after an interrupted worker. Local preflight accepts bounded documents up to 100,000 resources / 20 MiB and the offline extractor has a two-minute process safeguard for larger inputs.

Validation: 4,588 unit and microbenchmark tests passed (five existing skips); all Python version jobs and the package build passed on this head. The focused map suite includes a document above the original 50,000-resource bound. This PR remains open for public package release coordination.

[maximelb]

Adversarial self-review from a pristine archive of de7ee15: checked the bounded local preflight, receipt polling and same-document retry, status selectors, the offline extractor process limit, and public documentation for unintended internal names or customer data. The full unit and microbenchmark suite passed (4,588 tests; five existing skips); all supported Python CI jobs and the package build passed. No open issues found. This PR remains open for release coordination.