Bound dedup state for oversized messages

Add seen message signatures only after capture succeeds so rejected oversized messages do not stay in dedup memory, and verify signature state remains empty after truncation.