fix: cap file-backed safety reads

[apstndb]

Summary

• Read CLI_OUTPUT_TEMPLATE_FILE through the shared file-safety loader
• Cap GCS sample reads even when object metadata changes after the size check
• Reject negative MAX_PARTITIONED_PARALLELISM values
• Add regression coverage for the new guards

Tests

• make check

[gemini-code-assist]

Code Review

This pull request introduces safety limits and input validation across several components. It limits the maximum file size when loading sample databases from GCS using io.LimitReader, secures template file reading via filesafety.SafeReadFile, and adds a validator to ensure MAX_PARTITIONED_PARALLELISM is non-negative. Comprehensive unit tests have been added to verify these safety boundaries. I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Code Metrics Report

📊 View detailed coverage report (available for 7 days)

	main (ebef5f1)	#776 (dd3518b)	+/-
Coverage	72.9%	73.1%	+0.1%
Code to Test Ratio	1:1.3	1:1.3	+0.0
Test Execution Time	1m52s	1m39s	-13s

Details

  |                     | main (ebef5f1) | #776 (dd3518b) |  +/-  |
  |---------------------|----------------|----------------|-------|
+ | Coverage            |          72.9% |          73.1% | +0.1% |
  |   Files             |             87 |             87 |     0 |
  |   Lines             |           7809 |           7814 |    +5 |
+ |   Covered           |           5697 |           5715 |   +18 |
+ | Code to Test Ratio  |          1:1.3 |          1:1.3 |  +0.0 |
  |   Code              |          18190 |          18201 |   +11 |
+ |   Test              |          24369 |          24473 |  +104 |
+ | Test Execution Time |          1m52s |          1m39s |  -13s |

Code coverage of files in pull request scope (81.3% → 84.4%)

Files	Coverage	+/-	Status
internal/mycli/sample_databases.go	81.9%	+7.1%	modified
internal/mycli/var_custom_handlers.go	71.4%	0.0%	modified
internal/mycli/var_defs.go	95.1%	+0.0%	modified

---

Reported by octocov