fix(provers): bounded_read_proof_file helper + 25 wrapper migrations

Closes 25 of the 26 panic-attack UnboundedAllocation findings flagged
in reports/panic-attack-chunks/src-rust.json (deferred follow-up from
2026-04-25 evening session).

Adds src/rust/provers/io.rs with `bounded_read_proof_file` capping
proof-file reads at 64 MiB via `AsyncReadExt::take(N+1)` (TOCTOU-safe,
errors on overflow rather than truncating).  Migrates 25 prover
backends from bare `tokio::fs::read_to_string(&path)` to the bounded
helper:

  abella, acl2s, arend, athena, boogie, cameleer, cubical_agda,
  dedukti, hp_ecosystem, isabelle_zf, lambda_prolog, lean3, matita,
  mercury, mizar_ar, naproche, nitpick, nunchaku, opensmt, prover9,
  rocq, smtrat, typed_wasm, uppaal_stratego, zipperposition

The 26th finding (integrity/solver_integrity.rs) is a TOML manifest
read at startup from an operator-controlled path — different threat
shape, deferred to a follow-up.

The 47 unflagged backends already pass the panic-attack heuristic
(detector treats `read_to_string` as bounded if the file's source
contains the word "limit"); migrating them now would be scope creep
beyond closing the surfaced findings.  Future estate-wide pass can
fold them in.

io.rs ships with two unit tests (small_file_reads_fully,
oversized_file_errors) — both pass under cargo test --lib.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -74,7 +74,7 @@ impl ProverBackend for AbellaBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path)
+        let content = super::bounded_read_proof_file(&path)
             .await
             .with_context(|| format!("Abella: reading {}", path.display()))?;
         self.parse_string(&content).await

src/rust/provers/abella.rs

@@ -56,7 +56,7 @@ impl ProverBackend for Acl2sBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path)
+        let content = super::bounded_read_proof_file(&path)
             .await
             .with_context(|| format!("ACL2s: reading {}", path.display()))?;
         self.parse_string(&content).await

src/rust/provers/acl2s.rs

@@ -47,7 +47,7 @@ impl ProverBackend for ArendBackend {
         }
     }
     async fn parse_file(&self, p: PathBuf) -> Result<ProofState> {
-        let c = tokio::fs::read_to_string(&p)
+        let c = super::bounded_read_proof_file(&p)
             .await
             .with_context(|| format!("Arend: reading {}", p.display()))?;
         self.parse_string(&c).await

src/rust/provers/arend.rs

@@ -46,7 +46,7 @@ impl ProverBackend for AthenaBackend {
         }
     }
     async fn parse_file(&self, p: PathBuf) -> Result<ProofState> {
-        let c = tokio::fs::read_to_string(&p)
+        let c = super::bounded_read_proof_file(&p)
             .await
             .with_context(|| format!("Athena: reading {}", p.display()))?;
         self.parse_string(&c).await

src/rust/provers/athena.rs

@@ -59,7 +59,7 @@ impl ProverBackend for BoogieBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path)
+        let content = super::bounded_read_proof_file(&path)
             .await
             .with_context(|| format!("Boogie: reading {}", path.display()))?;
         self.parse_string(&content).await

src/rust/provers/boogie.rs

@@ -63,7 +63,7 @@ impl ProverBackend for CameleerBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path)
+        let content = super::bounded_read_proof_file(&path)
             .await
             .with_context(|| format!("Cameleer: reading {}", path.display()))?;
         self.parse_string(&content).await

src/rust/provers/cameleer.rs

@@ -74,7 +74,7 @@ impl ProverBackend for CubicalAgdaBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path).await?;
+        let content = super::bounded_read_proof_file(&path).await?;
         self.parse_string(&content).await
     }
 

src/rust/provers/cubical_agda.rs

@@ -69,7 +69,7 @@ impl ProverBackend for DeduktiBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path)
+        let content = super::bounded_read_proof_file(&path)
             .await
             .with_context(|| format!("Dedukti: reading {}", path.display()))?;
         self.parse_string(&content).await

src/rust/provers/dedukti.rs

@@ -183,7 +183,7 @@ impl ProverBackend for HPEcosystemBackend {
     }
 
     async fn parse_file(&self, path: PathBuf) -> Result<ProofState> {
-        let content = tokio::fs::read_to_string(&path)
+        let content = super::bounded_read_proof_file(&path)
             .await
             .with_context(|| format!("HP ecosystem: reading {}", path.display()))?;
         self.parse_string(&content).await