fix(integrity): bounded_read_config helper for solver manifest

Add src/rust/integrity/io.rs — sync bounded read for operator-controlled
TOML manifest paths, capped at 1 MiB (MAX_CONFIG_BYTES).  Same
principle as provers/io.rs but sync rather than async.

Wire into integrity/mod.rs (pub mod io; pub use io::bounded_read_config)
and replace the bare std::fs::read_to_string call at
solver_integrity.rs:85 with super::io::bounded_read_config.

Closes the 1 remaining UnboundedAllocation in src/rust/ flagged by
panic-attack.  Two unit tests (small_config_reads_fully,
oversized_config_errors) — both pass; lib total 670/0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

src/rust/integrity/io.rs

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+//! Sync bounded read for operator-controlled config files.
+//!
+//! Solver manifest paths are operator-controlled TOML files (not user-supplied
+//! proof files), so a sync read is appropriate.  The same bound principle
+//! as [`crate::provers::io::bounded_read_proof_file`] applies: cap at
+//! [`MAX_CONFIG_BYTES`] and error rather than truncate.
+
+use anyhow::{Context, Result};
+use std::path::Path;
+
+/// Maximum byte length for a solver manifest config read (1 MiB).
+pub const MAX_CONFIG_BYTES: u64 = 1024 * 1024;
+
+/// Read a UTF-8 config file (e.g. solver manifest TOML), bounded at [`MAX_CONFIG_BYTES`].
+///
+/// Uses `File::take(N+1)` so an oversized file is detected in a single
+/// read pass — no TOCTOU race against `metadata().len()`.
+pub fn bounded_read_config<P: AsRef<Path>>(path: P) -> Result<String> {
+    use std::io::Read;
+    let path = path.as_ref();
+    let file = std::fs::File::open(path)
+        .with_context(|| format!("opening config {}", path.display()))?;
+    let mut buf = String::new();
+    let mut limited = file.take(MAX_CONFIG_BYTES + 1);
+    limited
+        .read_to_string(&mut buf)
+        .with_context(|| format!("reading config {}", path.display()))?;
+    if buf.len() as u64 > MAX_CONFIG_BYTES {
+        return Err(anyhow::anyhow!(
+            "config file {} exceeds {} byte cap",
+            path.display(),
+            MAX_CONFIG_BYTES
+        ));
+    }
+    Ok(buf)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn small_config_reads_fully() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("solvers.toml");
+        std::fs::write(&path, b"[solvers]\nz3 = \"/usr/bin/z3\"\n").unwrap();
+        let s = bounded_read_config(&path).unwrap();
+        assert!(s.contains("solvers"));
+    }
+
+    #[test]
+    fn oversized_config_errors() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("big.toml");
+        let big = vec![b'x'; (MAX_CONFIG_BYTES + 1024) as usize];
+        std::fs::write(&path, &big).unwrap();
+        let err = bounded_read_config(&path).unwrap_err();
+        assert!(err.to_string().contains("exceeds"));
+    }
+}

src/rust/integrity/mod.rs

@@ -7,8 +7,10 @@
 //! known-good manifest. If a mismatch is detected, the solver is marked as
 //! untrusted and will not be used.
 
+pub mod io;
 pub mod solver_integrity;
 
+pub use io::bounded_read_config;
 pub use solver_integrity::{
     IntegrityChecker, IntegrityStatus, SolverIntegrityReport, SolverManifest, SolverManifestEntry,
 };

src/rust/integrity/solver_integrity.rs

@@ -83,7 +83,7 @@ pub struct IntegrityChecker {
 impl IntegrityChecker {
     /// Create a new integrity checker from a manifest file
     pub fn from_manifest_file(path: &Path) -> Result<Self> {
-        let content = std::fs::read_to_string(path)
+        let content = super::io::bounded_read_config(path)
             .with_context(|| format!("Failed to read solver manifest: {}", path.display()))?;
         let manifest: SolverManifest =
             toml::from_str(&content).with_context(|| "Failed to parse solver manifest TOML")?;