Limit the size of the agent registry response #2382

Summary

The agent registry response is read into memory without a size limit.

Why it matters

A compromised or misconfigured CDN or registry can return a very large response and exhaust memory, which crashes the app (denial of service).

Proposal

• Set a maximum response size and abort the read when it is exceeded.
• Set a request timeout.
• Validate the response against a schema before use.

Acceptance criteria

• Responses above the limit are rejected with a clear error, and the app stays responsive.
• A unit test covers an oversized registry response.