037825c1f2
On Linux, /usr/bin/python3 is >1MB, so the size check fired before the NUL check could run — the binary was returned as unsafe=True (blocked) instead of (None, False) (skip). Reorder: read the bounded chunk first, check for NUL bytes (binary → skip), then check size (oversized text → fail closed).