fix: bound three unbounded file reads (resolves self-scan Critical) (#51)

## Summary

Self-scanning panic-attack with the latest release surfaced a **Critical
UnboundedAllocation** in `attestation/mod.rs::verify_attestation_file` —
and, on closer inspection, two sibling sites the analyzer's per-file
heuristic glossed over. All three were the last residual violations of
the codebase-wide invariant that every file read must be
capacity-bounded.

## Discovery path

Ran the freshly-built release of panic-attack on its own source tree:

```
./target/release/panic-attack assail . --output /tmp/panic-self-scan.json
```

Among the 12 findings, one Critical pointed at `src/attestation/mod.rs`
— the heuristic correctly fired because that file has **zero** other
`.take(...)` calls. The other two sites (`src/assemblyline.rs:120`,
`src/assail/mod.rs:230`) live in files that DO use `.take(...)`
elsewhere, so the analyzer's per-file all-or-nothing classifier flagged
them as bounded overall. Manual triage caught those — separate concern,
doesn't need analyzer changes here.

## Fixes

All three follow the established pattern of every other read in the
codebase (`File::open` + `.take(LIMIT)` + `.read_to_string`).

| Site | Cap | Rationale |
|---|---|---|
| `src/attestation/mod.rs::verify_attestation_file` | 16 MiB | JSON
envelopes embed three hashes plus a small signature; legitimate
envelopes < 1 MiB. |
| `src/assemblyline.rs::load_cache_file` | 256 MiB | Fingerprint caches
grow with estate size; large enough for multi-thousand-repo rollups. |
| `src/assail/mod.rs::load_user_classifications` | 4 MiB | Hand-edited
audit a2ml registries are small. |

## Verification

- [x] `cargo build --bin panic-attack --features signing,http` — clean
- [x] `cargo clippy --all-targets --features signing,http -- -D
warnings` — clean
- [x] `cargo test --bin panic-attack --features signing,http` — 236
passed, 0 failed
- [x] `cargo fmt --check` — clean
- [x] **Self-scan before**: 12 findings (1 Critical UnboundedAllocation)
- [x] **Self-scan after**: 11 findings (Critical resolved; residuals are
intentional — `examples/vulnerable_program.rs` unsafe blocks, test
unwraps, etc.)
- [x] GPG-signed commit

## Out of scope

The analyzer's per-file heuristic for `read_to_string` boundedness is
correct-by-default (files that use `.take(...)` are *probably* bounded
throughout), but the two sites it missed argue for a per-call check.
That's a detector improvement, separate from these data-path fixes;
would file as a follow-up if the team thinks it's worth it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

src/assail/mod.rs

@@ -225,11 +225,25 @@ pub fn load_user_classifications(project_root: &Path) -> Vec<UserClassification>
             .join("assail-classifications.a2ml"),
         project_root.join(".panic-attack-classifications.a2ml"),
     ];
+    // User-classification a2ml files are hand-edited audit registries. A
+    // legitimate one rarely exceeds a few dozen KiB. Capping at 4 MiB
+    // stops a malicious or accidental input from exhausting memory during
+    // a multi-thousand-repo mass-panic sweep.
+    use std::io::Read;
+    const CLASSIFICATIONS_FILE_READ_LIMIT: u64 = 4 * 1024 * 1024;
+
     let mut content = String::new();
     for p in &candidate_paths {
-        if let Ok(c) = fs::read_to_string(p) {
-            content = c;
-            break;
+        if let Ok(mut f) = fs::File::open(p) {
+            let mut buf = String::new();
+            if (&mut f)
+                .take(CLASSIFICATIONS_FILE_READ_LIMIT)
+                .read_to_string(&mut buf)
+                .is_ok()
+            {
+                content = buf;
+                break;
+            }
         }
     }
     if content.is_empty() {

src/assemblyline.rs

@@ -115,9 +115,20 @@ impl FingerprintCache {
         Ok(())
     }
 
-    /// Load fingerprint cache from a standalone cache JSON file
+    /// Load fingerprint cache from a standalone cache JSON file.
+    ///
+    /// Bounded at 256 MiB — fingerprint caches grow with the size of the
+    /// estate being scanned, but even an aggressive multi-thousand-repo
+    /// rollup should land well under this cap. A larger file is almost
+    /// certainly corrupted or hostile.
     pub fn load_cache_file(path: &Path) -> Result<Self> {
-        let content = fs::read_to_string(path)?;
+        use std::io::Read;
+        const CACHE_FILE_READ_LIMIT: u64 = 256 * 1024 * 1024;
+
+        let mut content = String::new();
+        fs::File::open(path)?
+            .take(CACHE_FILE_READ_LIMIT)
+            .read_to_string(&mut content)?;
         let cache: Self = serde_json::from_str(&content)?;
         Ok(cache)
     }

src/attestation/mod.rs

@@ -67,8 +67,19 @@ pub enum VerifyResult {
 /// with a list of failure reasons otherwise.
 pub fn verify_attestation_file(path: &std::path::Path) -> anyhow::Result<VerifyResult> {
     use sha2::{Digest, Sha256};
-
-    let content = std::fs::read_to_string(path)
+    use std::io::Read;
+
+    // Attestation envelopes are JSON. They embed three hashes plus a small
+    // signature; legitimate envelopes are well under 1 MiB. Capping at
+    // 16 MiB stops a malicious or accidental input from exhausting memory
+    // before verification can even begin.
+    const ATTESTATION_FILE_READ_LIMIT: u64 = 16 * 1024 * 1024;
+
+    let mut content = String::new();
+    std::fs::File::open(path)
+        .map_err(|e| anyhow::anyhow!("opening {}: {}", path.display(), e))?
+        .take(ATTESTATION_FILE_READ_LIMIT)
+        .read_to_string(&mut content)
         .map_err(|e| anyhow::anyhow!("reading {}: {}", path.display(), e))?;
 
     let envelope: A2mlEnvelope = serde_json::from_str(&content)