perf(updater): read the downloaded archive in one bounded allocation

Before verifying a downloaded archive, both updaters slurped it into a
string with an istreambuf_iterator, which grows the buffer repeatedly
and reallocates as it reads a multi-megabyte file. It also placed no
upper bound on the size it would read into memory.

- A shared readFileExact helper sizes the file first and reads it in a
  single allocation, failing closed if the file is missing, empty,
  larger than a caller-supplied cap, or comes up short. A truncated read
  can never reach the SHA-256 / signature verifier.
- Both updaters use it with the existing max-archive cap.

Tests cover a good read, a read exactly at the cap, over the cap, an
empty file, and a missing file.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/util/http_download.cpp

@@ -8,8 +8,10 @@
 
 #include <curl/curl.h>
 
+#include <cstdint>
 #include <cstdio>
 #include <filesystem>
+#include <fstream>
 #include <system_error>
 #include <utility>
 
@@ -155,5 +157,18 @@ bool httpDownloadToFile(const std::string& url, const std::string& destPath,
     return true;
 }
 
+bool readFileExact(const std::string& path, std::string& out, std::uintmax_t maxBytes)
+{
+    out.clear();
+    std::ifstream f(path, std::ios::binary | std::ios::ate);
+    if (!f) return false;
+    const std::streamoff size = f.tellg();
+    if (size <= 0 || static_cast<std::uintmax_t>(size) > maxBytes) return false;
+    f.seekg(0, std::ios::beg);
+    out.resize(static_cast<std::size_t>(size));
+    if (!f.read(out.data(), size) || f.gcount() != size) { out.clear(); return false; }
+    return true;
+}
+
 } // namespace util
 } // namespace dragonx