fix: bake CI deps into Docker image, fix chunk use_metadata OOB

- Build and push fastsync-ci:v8 with lcov, valgrind, clang baked in
- Remove all apt-get install steps from CI (v8 has them pre-installed)
- Fix chunk.c use_metadata=true OOB: add remaining_size guard before
  metadata_from_buf reads past the buffer. The bug allowed network-facing
  chunk_deserialize to heap-buffer-overflow on crafted inputs.
- Also guard against unsigned underflow on remaining_size - sizeof(int)

src/shared/chunk.c

@@ -120,10 +120,23 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     free(path);
 
     if (use_metadata) {
+      if (remaining_size < sizeof(int)) {
+        log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata");
+        array_list_delete(files);
+        return NULL;
+      }
       file->metadata = metadata_from_buf(&data_pointer);
       remaining_size -= sizeof(int);
-      if (file->metadata)
+      if (file->metadata) {
+        if (remaining_size < FILE_METADATA_WIRE_SIZE) {
+          log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata body");
+          free(file->metadata);
+          file->metadata = NULL;
+          array_list_delete(files);
+          return NULL;
+        }
         remaining_size -= FILE_METADATA_WIRE_SIZE;
+      }
     }
 
     if (remaining_size < sizeof(size_t)) {