fix(snapshot): bump FetchSnapshotConfig read cap from 1 MiB to 64 MiB

[tonicmuroq]

Fixes #2.

Summary

pull.go:159 reads the snapshot config blob via io.ReadAll(io.LimitReader(body, 1<<20)) with the comment "config blob is tiny", but the SnapshotConfig embeds per-file SparseMap fields. A 4 GiB Windows guest running an Electron app with a live Firebase WebSocket signed in produces sparse maps in the high-hundred-KB range per fragmented file, and the config blob easily exceeds 1 MiB once memory-ranges and overlay.qcow2 are both accounted for.

Observed live:

field	bytes
files["memory-ranges"].sparseMap	580,107
files["overlay.qcow2"].sparseMap	611,926
base config fields	~few KB
total config blob	1,367,436

Symptom on the wake side:

ERR wake default/<vm> error="pull hibernation snapshot <name>:
    stream snapshot:
    fetch snapshot config:
    parse snapshot config: unexpected end of JSON input"

io.LimitReader returns EOF after 1,048,576 bytes; io.ReadAll swallows the EOF; the caller hands the truncated buffer to json.Unmarshal, which fails on the unterminated structure.

Fix

• Raise the cap to 64 MiB (still bounded — defends against a malicious manifest pointing at an arbitrarily large config blob).
• Pre-check desc.Size so we reject oversize blobs before any byte is read.
• Add a streaming overflow guard for the case where the descriptor lies about Size.

The reader path is the only thing that changes; pushers and on-disk format are untouched.

Relationship to cocoonstack/cocoon#23

Independent of #23. #23 addressed the writer-side tar PAX cap (a single file's sparse map > 1 MiB couldn't be encoded). This is the reader-side config cap (aggregate sparse maps + config metadata > 1 MiB couldn't be parsed). Both bugs share the same triggering condition (live Firebase agent → fragmented memory) but live in different layers.

Test plan

• TestFetchSnapshotConfigOverOneMiB — builds a real ~1.4 MB SnapshotConfig with two fragmented sparse maps and asserts parse succeeds. Would have failed under the old 1 MiB cap with "unexpected end of JSON input".
• TestFetchSnapshotConfigRejectsOversizeDescriptor — descriptor advertising > 64 MiB is rejected before any read.
• go test ./snapshot/ — all existing tests still pass alongside the new ones.

🤖 Generated with Claude Code