A prudent planetary limit for geologic carbon storage