Validate downloads before installing workspace files

docs/internal/storage.md

@@ -55,6 +55,11 @@ not own discovery, defaults, or configuration validation.
 - bounded reads never retain more than the caller's limit plus one byte and do
   not replace owner-specific size policy.
 - publish ordering semantics are owned by stage/app code, not storage adapters.
+- A caller that installs remote content into a canonical workspace path first
+  writes a sibling temporary file, validates the complete object against its
+  owner-specific contract, and only then replaces the destination. Temporary
+  files used solely for remote comparisons are removed by their callers and do
+  not represent installed workspace state.
 
 ## Implementation And Tests