fix(snapshot): enforce fs limits before expanding v2 snapshot chunks

[chaliy]

Motivation

• v2 snapshot decoding materialized file contents via SnapshotGraph::materialize before the target filesystem's FsLimits were applied, allowing small containers to expand to gigabytes and cause OOM/CPU exhaustion (TM-SNAP-004).

Description

• Pass the target FsLimits into SnapshotGraph::materialize and into decode_sealed so decoding uses the live filesystem limits rather than always materializing up to the old 4GiB backstop. (crates/bashkit/src/snapshot/mod.rs, crates/bashkit/src/snapshot/graph.rs).
• Replace the old unconditional materialization budget with a CheckoutBudget derived from FsLimits and enforce per-file (max_file_size) and aggregate (max_total_bytes) checks before allocating or expanding chunked files; retain the 4GiB absolute ceiling only as a final backstop for unlimited backends. (SnapshotGraph::materialize, resolve_file).
• Add a regression test configured_file_limit_is_refused_before_materializing_chunks validating that configured per-file limits reject repeated-chunk manifests before expansion, and update existing snapshot graph tests to use the new budget API. (crates/bashkit/src/snapshot/graph.rs tests).
• Update threat-model prose to state that live filesystem file-size and total-byte limits are enforced prior to chunk materialization (TM-SNAP-004). (knowledge/security/threat-model.md, crates/bashkit/docs/threat-model.md).

Testing

• Ran the snapshot graph unit tests with cargo test -p bashkit snapshot::graph::tests --no-default-features and all tests passed (7/7).
• Ran formatting and project checks: cargo fmt --all -- --check and just check-okf, both succeeded.
• Ran a broader cargo test invocation for the crate test profile used above and the focused integration/security checks in CI slices; the modified snapshot tests passed in that run.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	07f7b8c	Commit Preview URL	Aug 07 2026, 09:39 AM