- Read maxAssetDownloadSize+1 bytes and error if exceeded, preventing
silent truncation that could write a broken management.html to disk
- Log explicit warning when fallback URL is used without digest
verification, so users are aware of the reduced security guarantee