Enforce a maximum distance between two versions when replicating

[cdata]

To mitigate abuse, we should probably cap the spread between revisions to some finite value that is permissive of 99% of usage. Maybe somewhere in the ballpark of 1~10k revisions. It should be a large-but-finite number. We can first do a smoke check of the Lamport order, which should be monotonically increasing over the space of the versions. Then, as we crawl the history, we can fail if we cross some configured threshold of versions.

The recourse for the client should be to checkpoint at some version and request the entire sphere at that version.