feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkg/config/config_test.go

@@ -143,3 +143,39 @@ func TestLoadAppliesLogEnvironmentOverrides(t *testing.T) {
 		t.Fatalf("Log.Format = %q, want json", cfg.Log.Format)
 	}
 }
+
+func TestDefaultIncludesFileConfig(t *testing.T) {
+	cfg := Default()
+	if cfg.File.MaxWriteBytes != 1<<20 {
+		t.Fatalf("File.MaxWriteBytes = %d, want 1048576", cfg.File.MaxWriteBytes)
+	}
+}
+
+func TestLoadParsesFileConfigFromYAML(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	data := []byte(`file:
+  maxWriteBytes: 128
+`)
+	if err := os.WriteFile(path, data, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.File.MaxWriteBytes != 128 {
+		t.Fatalf("got %d", cfg.File.MaxWriteBytes)
+	}
+}
+
+func TestLoadAppliesFileEnvironmentOverride(t *testing.T) {
+	t.Setenv("CODESPACE_FILE_MAX_WRITE_BYTES", "256")
+	cfg, err := Load(filepath.Join(t.TempDir(), "missing.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.File.MaxWriteBytes != 256 {
+		t.Fatalf("got %d", cfg.File.MaxWriteBytes)
+	}
+}