Bound external result file reads

internal/stage/extract.go

@@ -349,9 +349,9 @@ func checksumRegularFile(path string, requireJSON bool) (string, error) {
 	if info.Size() == 0 {
 		return "", fmt.Errorf("path %q must be non-empty", path)
 	}
-	data, err := os.ReadFile(path)
+	data, err := fileops.ReadRegularFile(path, artifacts.MaxExtractionPayloadBytes)
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("notarius lane result exceeds or cannot be read within %d-byte limit: %w", artifacts.MaxExtractionPayloadBytes, err)
 	}
 	if requireJSON && !json.Valid(data) {
 		return "", fmt.Errorf("path %q is not valid JSON", path)