fix(corpus): cap collectFile's read at bytelimit.DefaultMaxInputBytes

collectFile used a bare os.ReadFile while walking cloned third-party
repositories for the training corpus — the one file-ingestion loop
in the codebase reading genuinely untrusted external content without
the byte-cap every other read site already applies (bytelimit,
internal/rules/githooksync, internal/schema). A single oversized file
in a source repo used to be read into memory in full; it now fails
the walk instead.

Ref: docs/development/high-performance-go.md ("os.ReadFile on huge
inputs: one giant alloc, all resident").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UCh2j2oeSw6UgNsmpjRonL

Author: claude

internal/corpus/collect.go

@@ -9,6 +9,8 @@ import (
 	"path/filepath"
 	"strings"
 	"unicode/utf8"
+
+	"github.com/jeduden/mdsmith/internal/bytelimit"
 )
 
 // Collect gathers markdown records from configured sources.
@@ -174,7 +176,7 @@ func collectFile(
 		return Record{}, false, nil
 	}
 
-	content, err := os.ReadFile(fullPath)
+	content, err := bytelimit.ReadFileLimited(fullPath, bytelimit.DefaultMaxInputBytes)
 	if err != nil {
 		return Record{}, false, fmt.Errorf("read file %s: %w", fullPath, err)
 	}

internal/corpus/collect_test.go

@@ -1,9 +1,12 @@
 package corpus
 
 import (
+	"bytes"
 	"os"
 	"path/filepath"
 	"testing"
+
+	"github.com/jeduden/mdsmith/internal/bytelimit"
 )
 
 func TestCollect_HappyPath(t *testing.T) {
@@ -207,6 +210,45 @@ func TestCollect_ErrorPath(t *testing.T) {
 	}
 }
 
+// TestCollect_OversizedFile_ReturnsError guards against an unbounded
+// os.ReadFile on a corpus source: collectFile ingests markdown from
+// cloned third-party repositories, which are untrusted input
+// (docs/development/high-performance-go.md — "os.ReadFile on huge
+// inputs: one giant alloc, all resident"). A file over the shared
+// bytelimit.DefaultMaxInputBytes cap must fail the walk rather than
+// being read into memory in full.
+func TestCollect_OversizedFile_ReturnsError(t *testing.T) {
+	t.Parallel()
+
+	root := filepath.Join(t.TempDir(), "docs")
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	oversized := bytes.Repeat([]byte("a"), int(bytelimit.DefaultMaxInputBytes)+1)
+	if err := os.WriteFile(filepath.Join(root, "huge.md"), oversized, 0o644); err != nil {
+		t.Fatalf("write oversized markdown: %v", err)
+	}
+
+	cfg := &Config{
+		CollectedAt:      "2026-02-16",
+		MinWords:         1,
+		MinChars:         1,
+		LicenseAllowlist: []string{"MIT"},
+		Sources: []SourceConfig{{
+			Name:       "seed",
+			Repository: "github.com/acme/seed",
+			Root:       root,
+			CommitSHA:  "abc123",
+			License:    "MIT",
+		}},
+	}
+
+	_, err := Collect(cfg, t.TempDir())
+	if err == nil {
+		t.Fatal("Collect: expected an error for a file over the byte-limit cap, got nil")
+	}
+}
+
 // --- reportProgress ---
 
 // TestReportProgress pins all three branches: nil cfg is a no-op,