fix(sandbox): cap the Go daemon's file-read path at 10MB

[pedrofrxncx]

Follows the same bug class as open PR #6039 (/edit file-read cap), but on a different route: Read's text path (packages/sandbox/daemon-go/internal/routes/fs.go).

/read already caps its image path at maxImageBytes (5MB), but for a text file it falls through to an unconditional os.ReadFile(filePath) regardless of size. A large text file (a log, a generated artifact, an oversized decofile) gets read fully into memory with no bound, which can OOM the daemon and tear down the sandbox pod on the next missed health probe — the exact failure mode the file's own decodeBody comment already documents for the request-body side.

Added a maxTextReadBytes (10MB, matching the cap #6039 is adding to /edit) check right before the read, returning a 400 with the file size and cap instead of buffering the whole file.

Failure scenario: an agent runs /read against a >10MB text file in the sandbox → daemon buffers the entire file into memory → repeated/concurrent large reads can push the daemon over its memory limit and get the pod killed mid-session.

Regression test: TestReadRejectsOversizedTextFile (fixture file just over the cap, expects 400 with a "too large" message) and TestReadAllowsTextFileUnderCap (small file still reads fine) in fs_test.go.

Reviewer check: cd packages/sandbox/daemon-go && go test ./internal/routes/...

Locally ran: go build ./..., go test ./internal/routes/..., gofmt -l (clean), go vet ./internal/routes/... (clean). Full CI validates the rest.

---

Summary by cubic

Caps text-file reads in the sandbox Go daemon’s /read route at 10MB to prevent OOMs. Previously, the text path used unbounded os.ReadFile; now requests for files >10MB return 400 with the file size and cap. This aligns with the /edit 10MB cap.

Review notes

• Adds maxTextReadBytes and a pre-read size check in packages/sandbox/daemon-go/internal/routes/fs.go.
• Adds TestReadRejectsOversizedTextFile and TestReadAllowsTextFileUnderCap in packages/sandbox/daemon-go/internal/routes/fs_test.go.
• Verify with: cd packages/sandbox/daemon-go && go test ./internal/routes/...

^{Written for commit 134f0f2. Summary will update on new commits.}