Scope PGCheckpointer queries by tenant GID

Each Save and Load now derives tenant_id from the run GID and pins it
in the WHERE clause. A caller that supplies an ID from another tenant
fails closed instead of silently reading or overwriting cross-tenant
checkpoint data. Also rejects oversize checkpoints on load as a
read-side guard against a tampered or migrated row exceeding
MaxCheckpointBytes.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/agent/checkpoint.go

@@ -82,8 +82,6 @@ type (
 )
 
 const (
-	MaxCheckpointBytes = 10 * 1024 * 1024
-
 	AgentStatusSuspended        AgentStatus = "suspended"
 	AgentStatusAwaitingApproval AgentStatus = "awaiting_approval"
 )