Refuse an xz file of more than 1,024 blocks before decoding it (review 68, hq issue 345)

The xz reader keeps one delta or BCJ decoder for every block of a stream and frees them only when the
stream ends, so a file of many tiny blocks grows the heap with its length: about 67 MiB live for a 6 MB
`xz --block-size=1 --delta` file, about 5.6 GiB at the 512 MiB download cap.

The file's framing is now walked first, without decompressing: stream header, each block header, the
LZMA2 chunk headers (each carries its compressed size, so a chunk is skipped unread), padding, check,
index and footer. A file of more than 1,024 blocks or 16 streams is refused, as is an index whose block
count is not the count walked. The index alone is not trusted because the reader compares it with the
blocks only after decoding them all, so a lying index would still be decoded. Refusing delta and BCJ
outright was not chosen: it needs the same walk to see each block header, and would refuse sound
releases filtered with BCJ.

1,024 blocks keep at most about 0.35 MiB of decoders. Betterbird's archive is 1 stream with 1 block;
multi-threaded xz cuts blocks of 3 times the dictionary, so 512 MiB in blocks of 512 KiB still fits.
The library stays unforked.

internal/builder/upstream_file.go

@@ -198,7 +198,12 @@ func unpackUpstream(ctx context.Context, file, into, within string) error {
 		// may not carry: the seat's image is the catalogue's build-agent recipe, which installs git and docker-cli
 		// alone, and a release pinned as .tar.xz failed there on 2026-10-12 (hq issue 345). xzDictMax is a real
 		// maximum: a block whose LZMA2 dictionary is larger is refused before its dictionary is allocated
-		// (ErrMemlimit). What the stream unpacks to is bounded by untar (maxUpstream, maxEntries).
+		// (ErrMemlimit). The reader keeps a filter decoder for every block of a stream, so the file's framing is
+		// walked first and a file of more blocks than xzBlocksMax is refused before anything is decoded
+		// (xz_framing.go). What the stream unpacks to is bounded by untar (maxUpstream, maxEntries).
+		if err := xzWithinLimits(file); err != nil {
+			return err
+		}
 		zipped, err := xz.NewReader(buffered, xzDictMax)
 		if err != nil {
 			return fmt.Errorf("it is not an xz stream this build seat reads (a dictionary of %d MiB at most): %v",