Expose bounded envelope read (#69)

[sehkone]

Summary

• Expose the verifier bounded package-container read and its metadata outcomes for consumers that inspect untrusted envelope metadata without a trust set.
• Publish the release-format envelope bounds and lengths, while preserving the existing unbounded whole-container readers and documenting their intended use.
• Cover signed, unsigned, malformed, wrong-length, sparse-file, and external-consumer paths.

Closes #69

Test plan

• Read unsigned and correctly signed package metadata without a trust set.
• Report absent, present, wrong-length, and malformed half-zero envelope states.
• Read a sparse package advertising a multi-gigabyte block and report WrongLength without reading that block.
• Assert the exported bounds use the verifier signature and key-id lengths.
• Confirm the whole-container reader APIs retain their existing signatures and behavior.
• Run cargo fmt -- --check --config group_imports=StdExternalCrate.
• Run cargo clippy --all-targets -- -D warnings.
• Run cargo clippy --all-targets --features test-support -- -D warnings.
• Run cargo test.
• Run cargo test --features test-support.

[sehkone]

[Reviewer Round 1]

Approved — no findings.

The PR exposes the existing bounded path without duplicating it: verify_package still calls read_package_container with the exported fixed bounds (verify.rs), while external callers can inspect all three envelope outcomes through the new public API (payload.rs).

It also documents all four specified unbounded readers, publishes the verifier’s actual constants, and includes both an external-consumer integration test and the requested real sparse-file regression coverage. PR #70’s issue linkage and test plan are in order; there are no review-thread hygiene concerns.

[sehkone]

[Review Verdict Round 1: APPROVED]

[sehkone]

Suggested squash commit

Title

Expose bounded envelope reader

Body

Allow metadata consumers to inspect untrusted package envelopes without
allocating blocks at attacker-controlled lengths. Keep the verifier and
public reader on the same bounded implementation.

Closes #69