I think the JTAG wires don't limit the length, but should limit the parasitic capacitance.
You should guarantee it can meet the programming timing spec.
Can you explain why you have such questions? Does your system have a limit use?
In order to keep the traces short I tend to put the jtag connector right next to the PSoC but when the board gets installed in the field the connector and the processor end up hidden underneath a bundle of cables. The only easily accessible space is a good 4.5" away from where the PSoC is located.
This sounds like a good candidate for a bootloader. So you can test/debug via JTAG in the lab and then deploy to the field using something like a UART.
Edit: cleaned up the grammar, that's what I get for replying on mobile.