fix: harden thothctl diagnostics

tools/thothctl/internal/output/sanitize_test.go

@@ -33,3 +33,16 @@ func TestSanitizeRedactsSecretFileContents(t *testing.T) {
 		t.Errorf("Sanitize() = %q, want redacted secret", got)
 	}
 }
+
+func TestSecretValuesFromFilesRejectsOversizedFiles(t *testing.T) {
+	t.Parallel()
+
+	secretFile := filepath.Join(t.TempDir(), "oversized-token")
+	if err := os.WriteFile(secretFile, make([]byte, 64*1024+1), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := SecretValuesFromFiles([]string{secretFile}); err == nil {
+		t.Fatal("SecretValuesFromFiles() error = nil, want oversized-file error")
+	}
+}