fix(consensus): cap export proposal signatures

Limit outbound TMProposeSet export signature attachments to ExportLimits::maxPendingExports so honest proposals stay within the same bound enforced by inbound proposal validation. Extra exports remain unsigned for that proposal and rely on the existing retry/expiry path.

src/xrpld/app/consensus/ConsensusExtensions.cpp

@@ -2068,12 +2068,21 @@ ConsensusExtensions::attachExportSignatures(
         return;
 
     auto const signerAcctID = calcAccountID(valPK);
+    std::uint8_t attached = 0;
 
     for (auto const& [stx, meta] : openLedger->txs)
     {
         if (!stx || stx->getTxnType() != ttEXPORT)
             continue;
 
+        if (attached >= ExportLimits::maxPendingExports)
+        {
+            JLOG(j_.debug())
+                << "Export: proposal signature attachment cap reached (max "
+                << +ExportLimits::maxPendingExports << ")";
+            break;
+        }
+
         auto const txHash = stx->getTransactionID();
 
         // Only attach our sig on the first proposal this round.
@@ -2113,6 +2122,7 @@ ConsensusExtensions::attachExportSignatures(
         if (sigBuf.size() > 0)
             s.addRaw(Slice(sigBuf.data(), sigBuf.size()));
         prop.add_exportsignatures(s.peekData().data(), s.peekData().size());
+        ++attached;
         //@@end export-attach-wire-sigs
 
         // Only store if we actually produced a signature.