#1351 runon: return up to 128 MiB of files when the build server supports it, streaming the install

ck-motor now advertises exec-remote-return/v3: a job may bring back up to 128 MiB of return_paths files (RETURN_LARGE_MAX_BYTES_CAP), up from 10 MiB. This PR adopts it, as agreed with MOTOR and SUBC, with no new agent-facing argument.

Two memory fixes come first, so a large return can't load a whole file into memory:

• Cross-filesystem install copies the verified staged file through a fixed 64 KiB buffer, instead of reading it into a Vec. Hash check, atomic install and refusals are unchanged.
• Out-of-order records waiting for a missing sequence number get an 8 MiB budget, independent of the return cap. Exceeding it uses the existing gap-recovery path, which reattaches from the committed cursor and never installs a file. Older checkpoints over the budget refetch instead of cloning the buffer.

Then:

• AFT requests 128 MiB only when the ck-motor it calls lists exec-remote-return/v3, and keeps 10 MiB otherwise.
• Cap refusal: a runner with a lower limit refuses at submit with invalid_params naming return_max_bytes and detail.max_bytes (ReturnCapRefusal), before any job exists. AFT then resubmits once at that cap. The resubmit keeps every other request field, including memory_mib, which is part of the job's identity, and the used retry survives a restart. No other refusal is retried.
• cortexkit-exec-remote-types stays at main's 0.2.18, one resolved version.

Not changed here: the bash tool description still says "10 MiB in total". New wording needs Ufuk's approval and will ride the next tool-text change. No new agent-visible refusal text.

Gate (linux,8c): 217 build-server, runon-return and return-file tests (including a 20 MiB cross-filesystem install with bounded reads and a verified hash, and the memory-preserving cap resubmit), formatting, and the Windows check. A live nested ck-motor round trip wasn't possible from a build-server job.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

runon jobs can now bring back up to 128 MiB of files with return_paths when the build server advertises exec-remote-return/v3, up from 10 MiB, and return large files through streaming instead of loading them into memory.

• The negotiated cap is requested only when the ck-motor supports v3; otherwise requests stay at 10 MiB.
• A runner with a lower limit refuses at submit time with invalid_params naming return_max_bytes, and AFT resubmits once at that cap, preserving all other request fields.
• Cross-filesystem installs copy staged files through a fixed 64 KiB buffer, and out-of-order records waiting for a missing sequence number are bounded by an 8 MiB budget.
• The bash tool description still says "10 MiB in total"; updated wording is deferred to the next tool-text change.