WS3: guard the unbounded tree paths (GetTree, AC Tree validation)

[shreyas-blacksmith]

Summary

Third and final workstream of the bazel-remote memory-envelope program (stacked on #32, which stacks on #27). This PR guards the two request paths whose memory is discovered mid-flight rather than declared up front, so no up-front reservation can ever cover them:

• WithGetTreeLimits — GetTree materializes the entire directory tree into one in-memory response (no pagination upstream). The guard is a fail-fast concurrency slot (TryAcquire, no queueing) plus a running response byte cap decremented by each directory's declared size before fetching it. Both trips return retryable ResourceExhausted and report to an optional metrics sink. Worst-case memory = slots × byte cap.
• WithTreeValidationSizeLimit — GetValidatedActionResult reads every referenced output-directory Tree blob wholly into memory. Sizes are declared in the ActionResult, so this is a pre-flight sum check; over-cap results degrade to a cache miss (always semantically safe — the client rebuilds), never an error, with a trip callback.

Both options default off; standalone bazel-remote behavior is unchanged.

The program (WS1–3)

WS	What it bounds	PR
WS1	zstd codec state: counted encoder admission (semaphore + sync.Pool), 1 MiB windows, waiter ceiling, batch identity-fallback	#27
WS2	LRU index metadata: WithMaxEntries resident-entry cap (~268 B/entry measured)	#32
WS3	Tree-path payloads: this PR (batch payload budget deferred behind an evidence bar — see the FA-side design doc)

Test plan

• TestGetTreeConcurrencyGuardFailsFast — held slot denies immediately, release restores service, handler releases its slot
• TestGetTreeResponseByteCap — over-cap aborts mid-traversal, cap smaller than root denies pre-unmarshal, exact cap serves the full tree
• TestGetTreeGuardsEndToEnd — option plumbing over the wire
• TestTreeValidationSizeLimit* — hit→miss flip attributable to the guard alone; exact cap admits; trip callback fires once with declared bytes
• full ./cache/... ./server/... suite passes

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled. (Staging)}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}