Bound preview verification I/O before reading candidate bytes
A destructive-operation preview should bound and time-limit its verification I/O before downloading candidate bytes, not only cap the final selected manifest. A preview can be non-mutating in domain state while still consuming unbounded network time or bandwidth. Pair an internal…