Bound preview verification I/O before reading candidate bytes

A destructive-operation preview should bound and time-limit its verification I/O before downloading candidate bytes, not only cap the final selected manifest. A preview can be non-mutating in domain state while still consuming unbounded network time or bandwidth. Pair an internal per-request/overall deadline with a pre-download aggregate byte ceiling, and independently prove zero domain mutations afterward.

This applies to previews that re-read or hash remote objects. It does not mean access logs, connection statistics, or provider metrics remain unchanged, so describe the operation as domain-non-mutating rather than literally side-effect-free. An external wall-clock timeout is a useful backstop, but it cannot replace internal cancellation and pre-I/O bounds.