fleet brokers: review-finding hardening for dual-bind transports (from PR #6514) #6515

Follow-up from PR #6514 (implements #6216, dual-bind Unix-socket listeners for queue-broker + secrets-broker), filed by queue worker task 11120 so the review findings are tracked, not lost at merge.

CodeRabbit posted 11 actionable comments on PR #6514 (2026-11-06T12:54Z), after the PR was verified (fleet-queue 39 tests pass, fleet-config 16 pass, live TCP+UDS smoke on both brokers). None were dispositioned in that PR; they are recorded here instead of blocking the verified dual-bind change (standing merge rule: merge when verified, fix forward).

Findings to disposition (fix, or reply on the PR #6514 thread why not):

• Major / Security: pkgs/fleet/crates/fleet-queue/src/queue_broker.rs ~line 723 — TCP request handling reads the request body before authentication; an unauthenticated client can stream a large/unfinished body before the 401. Reject unauthorized POSTs before reading the body; bound body size. Check the equivalent secrets-broker path.
• Major / Stability: pkgs/fleet/crates/fleet-queue/src/uds_http.rs ~line 58 and ~line 62 — see PR feat(fleet-queue): dual-bind Unix-socket listeners for queue-broker + secrets-broker (#6216) #6514 threads.
• Major / Data Integrity: uds_http.rs ~line 64 — see PR feat(fleet-queue): dual-bind Unix-socket listeners for queue-broker + secrets-broker (#6216) #6514 thread.
• Minor: uds_http.rs lines 64, 70, 98, 116, 119, 131 — stability/security/correctness notes, see PR feat(fleet-queue): dual-bind Unix-socket listeners for queue-broker + secrets-broker (#6216) #6514 threads.

Acceptance:

• Each PR feat(fleet-queue): dual-bind Unix-socket listeners for queue-broker + secrets-broker (#6216) #6514 CodeRabbit thread is fixed in a follow-up PR or answered with a reason.
• Body-size cap and read timeout (or an explicit documented decision against) on both broker transports.
• Tests named with their oracle per the testing doctrine (invariant/model/golden) where a cap/timeout is added.

Acceptance criteria

• Every CodeRabbit thread on PR feat(fleet-queue): dual-bind Unix-socket listeners for queue-broker + secrets-broker (#6216) #6514 is dispositioned: fixed in a follow-up PR, or answered on the thread with a reason.
• Both broker transports (queue-broker and secrets-broker, TCP and UDS) reject unauthorized POSTs before reading the request body, and enforce a body-size cap and a read timeout — or carry an explicit documented decision against, recorded on this issue.
• Regression tests cover the unauthenticated large/unfinished body case on the TCP path (oracle: the request is refused before the body is consumed).