Bound layer decompression during staging and extraction

[Copilot]

Three copy loops moved layer bytes with unbounded io.Copy, each suppressed from gosec with a //nolint:gosec // trusted layer content comment. Layer content is publisher-supplied and only digest-verified, so a gzip or sparse-tar bomb inside a legitimate image could decompress without limit into the shared staging root (/tmp/brewlet-runnable/...) or the bundle's classpath dirs.

Changes

• core/internal/artifact/blobs.go
  • Adds MaxLayerDecompressedBytes (8 GiB ceiling, lowerable by tests) and CopyBounded(dst, src, limit), which fails loudly once the limit is breached instead of expanding a bomb.
  • gunzipToFile copies through the cap and removes the half-written layer on breach, so a failed stage leaves nothing behind.
  • extractGzTar spends one budget across all entries (including the trailing gzip drain at EOF), so many small entries cannot bypass a per-entry cap.
• core/internal/runtime/launch.go
  • extractTar uses artifact.CopyBounded with the same per-tar budget.
• All three //nolint:gosec suppressions are removed — the G110 finding they hid is now addressed.
• Tests cover cap enforcement on all three sites, an accept-within-cap case, and partial-output cleanup.

func CopyBounded(dst io.Writer, src io.Reader, limit int64) (int64, error) {
	n, err := io.Copy(dst, io.LimitReader(src, limit+1))
	if err != nil {
		return n, err
	}
	if n > limit {
		return n, fmt.Errorf("layer exceeds decompression cap of %d bytes", MaxLayerDecompressedBytes)
	}
	return n, nil
}

The cap is an availability bound, not a payload constraint; per-layer limits could later ride the manifest's declared sizes where available.

• Fixes Layer extraction/gunzip has no decompression size cap (io.Copy //nolint:gosec "trusted layer content") #116