CAR reader now validates version==1, requires non-empty roots, rejects zero-length blocks, and enforces a 1 MiB per-block size limit (matching atmos). Fix readUvarint where the overflow check was dead code — shift was u6 (max 63) so the >= 64 check never triggered; replaced with a bounded for(0..10) loop. Add 17 CAR tests covering header validation, truncation, corruption, round-trip determinism, and size limits. Add 5 CAR benchmarks (read/write/round-trip with and without hash verification). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>