Validate and retain DebugInfo from untrusted packages

[huitseeker]

Summary

Package::read_from_bytes() used to discard DEBUG_INFO from untrusted .masp files. It now keeps valid debug data and rejects the whole package when that data is unsafe.

This matters for any tool or service that accepts full .masp files. Fuzzed packages reached the debug decoder, public lookup methods, error reporting, wire round trips, and embedded kernel extraction.

Trusted readers still check the MAST forest but may wait to check debug data until Package::debug_info(). Unchecked readers still skip MAST checks and remain limited to bytes that the same trusted system checked before.

Security impact

• A large debug section could exhaust memory while it was copied and expanded into tables. Debug payloads are now capped at 16 MiB. The decoder also caps strings at 100,000 rows, types at 1,000,000 rows, and each string at 4 KiB.
• Bad table links could panic below package validation. Fuzzing reached file paths, locations, error text, source roots, assembly records, and debug variables through public lookup and error paths. These paths now use checked lookup. Full package reads reject every bad link.
• Bad optional-index tags could reach unchecked conversion or indexing. They now return a decode error.
• Bad type data could trigger layout assertions, integer overflow, or excessive work. The decoder rejects invalid struct alignment, layout-free fields and enum values, invalid transparent structs, fields larger than u32::MAX, and arrays whose padded size is too large or overflows.
• Debug text could add fake log lines or alter terminal output in an error message. Validation now rejects control characters, including newlines and terminal escapes. String length limits also bound the size of printed text and paths.
• Bad source ranges could show the wrong place in an error. Validation rejects spans with an end before their start, assembly rows outside the source node's operation range, and duplicate or unordered operation indices.
• A large source map made each error lookup scan all rows. Rows must now be in strict order, and lookup uses binary search. With 65,536 rows, lookup took 14.6 ns instead of 13.6 us for the old scan shape.
• Debug data that passed weak checks could be saved, sent again, or used during execution and error reporting. Untrusted package reads now check it before returning. Valid data survives a read/write/read round trip.
• A hostile kernel could hide bad debug data inside an opaque outer package. Fuzzing reached this nested path. Kernel extraction now uses the untrusted reader, keeps valid nested debug data, and rejects bad nested data.

Performance

Times are paired Criterion estimates against origin/next on the same host.

Path	Before	After	Change
Untrusted, no debug data	6.178 us	6.214 us	+0.33%
Trusted, no debug data	6.248 us	6.249 us	+0.02%
Untrusted, with debug data	6.228 us	14.149 us	+126.95%
Trusted, with debug data	6.248 us	6.322 us	+1.08%
Trusted read plus debug decode	13.562 us	14.105 us	+4.17%

The untrusted debug path now does work that the old code skipped, so its 126.95% increase is not a
like-for-like regression. The matching read-plus-decode path changed by 4.17% (95% interval:
+3.99% to +4.37%), below the 5% limit. Packages without debug data changed by less than 0.4%.

Unblocks #3418.