fix: bound catalog acquisition before pilot staging

Launcher.Next.Infrastructure/FileSystemCatalogPackageAcquirer.cs

@@ -9,11 +9,14 @@ namespace Launcher.Next.Infrastructure;
 /// </summary>
 public sealed class FileSystemCatalogPackageAcquirer(string catalogRoot) : IPackageCatalogPackageAcquirer
 {
+    private const int MaxFiles = 256;
+    private const long MaxBytes = 512L * 1024 * 1024;
+
     public async Task<CatalogPackage?> AcquireAsync(PackageRequirement requirement, CancellationToken cancellationToken)
     {
         var root = Path.GetFullPath(catalogRoot);
         var candidate = Path.GetFullPath(Path.Combine(root, requirement.PackageId, requirement.RequiredVersion));
-        if (!IsWithin(root, candidate) || !Directory.Exists(candidate) || IsReparsePoint(candidate))
+        if (!Directory.Exists(root) || IsReparsePoint(root) || !IsWithin(root, candidate) || !Directory.Exists(candidate) || IsReparsePoint(candidate))
             return null;
 
         var manifestPath = Path.Combine(candidate, "package.manifest.json");
@@ -21,6 +24,10 @@ public sealed class FileSystemCatalogPackageAcquirer(string catalogRoot) : IPack
             return null;
 
         var manifest = PackageManifestJson.Parse(await File.ReadAllTextAsync(manifestPath, cancellationToken));
+        if (manifest.Files.Count > MaxFiles || manifest.Files.Sum(file => file.Length) > MaxBytes ||
+            manifest.Files.Any(file => string.IsNullOrWhiteSpace(file.Path) || Path.IsPathRooted(file.Path) ||
+                                      file.Path.Split(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar).Any(segment => segment is ".." or ".")))
+            return null;
         return new CatalogPackage(manifest, candidate);
     }