fix(cli): bound lockfile reads before JSON allocation

[TheHalfMoon]

Finding

A post-CF-13 input-bound audit on canonical main 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361 found that lockfile-consuming CLI paths commonly execute:

Lockfile::from_slice(&fs::read(path)?)?

Lockfile::from_slice validates schema/semantic structure after receiving the byte slice but does not impose an input byte limit itself. fs::read therefore allocates the complete caller-selected file before commandF can reject it.

Affected visible paths include at least:

• pkg verify;
• inspect;
• context;
• shared diff / classify / check path;
• terminology;
• impact;
• oracle;
• inspect any gate lock-loading path before closeout.

This contrasts with bounded report/SUSHI/gate input paths already present in the CLI.

Risk

A caller-controlled oversized lockfile can cause excessive memory allocation / process resource exhaustion before structured validation. No remote exploitability is claimed; this is an untrusted local-input/resource-bound defect.

Required repair

• define a conservative commandF-owned maximum lockfile input size based on legitimate package-closure evidence, not an arbitrary tiny cap;
• read at most MAX + 1 bytes before parsing;
• use one shared bounded lockfile-loading boundary across commands instead of duplicating limits;
• preserve schema v1/v2 compatibility rules and exact validation semantics;
• stable operational error classification/message without serializing sensitive host paths into machine-readable product evidence;
• ensure any library API intended for direct untrusted persisted-lock parsing either documents caller byte-bound responsibility or provides a bounded path as appropriate.

Tests

• exact-bound lockfile is admitted to parsing;
• limit+1 rejected before JSON parse;
• malformed under-limit input still reports parse failure;
• legitimate large multi-version schema-v2 closure remains accepted;
• every CLI lock-consuming path uses the common bounded loader;
• repeated oversized input produces stable failure classification;
• no regression in existing lock schema v1/v2 tests.

Governance

• separate from AF-01 planning PR docs(assurance): plan trusted development baseline #34;
• coordinate with cache verified-byte issues fix(terminology): consume the exact cache bytes that were verified #35/fix(cache): bind impact and oracle consumption to verified archive bytes #36 but do not make them one unreviewable patch;
• no CF semantic, CF-06 pin, or CF-10 corpus change;
• exact-head mandatory CI + path-applicable proof workflows + CodeRabbit/Qodo before merge.