stream checkpoint policy decoding

Decode policy JSON from a bounded reader instead of materializing the blob contents first.

This keeps policy reads small and rejects oversized policy blobs before parsing.