SEC-130: Harden attended snapshot bootstrap downloads

[huangminghuang]

Problem

Remote snapshot bootstrap previously buffered an unbounded response in memory and lacked explicit response-size, disk-capacity, and partial-file guarantees. The first hardening pass added network deadlines, but request-write coverage was incomplete and fixed time limits do not fit the trusted, attended bootstrap model.

Solution

• stream snapshot bodies through fixed 64 KiB parser/read buffers with one ceiling for fixed-length, chunked, and lengthless responses
• centralize decoded body increments so the bounded error diagnostic and main download loop share buffer setup, parser-read, need_buffer normalization, and byte accounting
• use the existing chain-state-db-size-mb value as the response-size ceiling; add no snapshot-specific timeout, size, or disk-reserve options
• keep the always-on 64 MiB disk-safety margin internal instead of exposing an unused per-download reserve field; deterministic disk tests inject only the free-space query through private test access
• report connection/request phases and five-second transfer updates with bytes, percentage, rate, and ETA when Content-Length is available
• keep network phases operator-controlled and make Ctrl+C cancel pending resolve, connect, request-write, response-header, metadata, and body-read operations
• preflight and periodically recheck disk capacity with a 64 MiB concurrent-consumer margin, then atomically rename successful downloads and remove .downloading files on failure or cancellation
• preserve up to 200 decoded bytes from non-200 response bodies in operator diagnostics without unbounded buffering
• reuse the metadata connection with one opt-in stale-connection retry for the idempotent download request
• require explicit download resource options and remove the unused legacy unbounded post_to_file overload

Validation

• 20 focused HTTP cases covering cancellation in write/header/body/metadata phases, progressing transfers without a total deadline, fixed/chunked response ceilings, bounded non-200 diagnostics, truncated fixed-length cleanup, progress totals, stale keep-alive reuse/retry, and disk budgets
• full test_chain_plugin suite: 14 cases passed
• focused chain-plugin option registration/removal and response-size validation
• snapshot_api_test coverage for latest and block-specific snapshot bootstrap; Python syntax validation passed after removing the obsolete option
• git diff --check

The system-contract e2e gate is not applicable because the PR diff does not change contracts/sysio.*.

Operational note

The selected snapshot endpoint is trusted and bootstrap is attended. Network phases therefore have no automatic deadline; a stalled provider waits for the operator to press Ctrl+C. Response bytes and disk usage remain bounded independently of that policy.

[heifner]

Three low-severity cleanup notes on the bounded download path — none blocking. The size ceiling, disk-headroom checks, cancellation, and stale-connection retry all look correct and are well covered by the new tests.