fix(envd): cap PostInit request body at 1 MiB with MaxBytesReader

[AdaAibaby]

Problem

Closes #3563

PostInit read the full request body with no size cap:

body, err := io.ReadAll(r.Body)  // no MaxBytesReader
defer memguard.WipeBytes(body)

Any process inside the VM that can reach the envd HTTP port can send an arbitrarily large body, allocating heap memory until envd is OOM-killed. The auth check happens after the full body is read, so no credentials are required.

envd is the sandbox control plane — OOM-killing it orphans all user processes, breaks graceful teardown (slot release, cleanup callbacks), and can corrupt pause/resume state.

Secondary issue: memguard.WipeBytes(body) is intended to scrub the access token from heap memory after use. If body is a multi-hundred-MiB allocation, Go's GC may have already paged parts of it to disk or the allocator may have moved the backing array before the deferred wipe runs, reducing the security guarantee.

Fix

Wrap r.Body with http.MaxBytesReader(w, r.Body, 1<<20) before io.ReadAll. 1 MiB is a generous upper bound — the largest legitimate /init payload carries EnvVars and CaBundle (multiple PEM certs) but no bulk data.

Oversized requests now return 413 Request Entity Too Large via a dedicated *http.MaxBytesError branch; all other read errors keep the existing 400 path.

Changes

Single file, packages/envd/internal/api/init.go (+17/-2 lines):

Change	Detail
r.Body = http.MaxBytesReader(w, r.Body, 1<<20)	Cap before io.ReadAll
errors.As(err, &maxErr) branch	Return 413 on oversized body
Existing 400 path preserved	All other read errors unchanged

No import changes needed (errors, io, net/http already imported).

Testing

• Normal orchestrator /init payloads are well under 1 MiB — no behaviour change for legitimate callers.
• A request with a body > 1 MiB now gets 413 and envd memory is unaffected.

[leonmeijer]

The new 1 MiB limit rejects an envd init payload that is still valid under the public sandbox contract: spec/openapi.yml does not cap envVars, while the orchestrator serializes the complete env map and CA bundle into POST /init and treats a 413 as a fatal create or resume failure. Add an equivalent admission limit at the public API boundary or choose a bound that is already guaranteed there so a successfully admitted sandbox cannot fail only at envd initialization.

This envd behavior change also leaves packages/envd/pkg/version.go at 0.6.13. Without the required version bump, X-Envd-Version and compatibility or rollout logic cannot distinguish nodes that enforce the new body limit.