fix(ingest): CRC-validate the primary ingest read, not just the resume path

[Sravan1011]

Closes #431.

Summary

#429 fixed the LeRobot resume path. The same hole was open one stage earlier, on the primary path every ingest takes: transform.py's read of the source file (open_reader) never asked for CRC validation, so a structurally valid MCAP with a damaged chunk payload transcoded without complaint and got a fresh, true receipt over corrupt bytes — #426's finding, one stage upstream.

What changed

• open_reader / PythonMcapEpisodeReader (reader.py) gain validate_crcs: bool = False, threaded straight into the existing make_reader(..., validate_crcs=...) call — the same shape doctor.py and fix(import): CRC-validate reused landing episodes before stamping receipts #429's fix already use.
• Default stays False, so app.py:1390, episode.py:311, and runtime/_templates.py:717 are unaffected: those read canonical files HFlow already produced and already identifies by content hash. Only transform.py's ingest read opts in with validate_crcs=True, since that's the one call reading someone else's file for the first time.
• ingest_ledger.classify_ingest_failure gets a new branch for mcap.stream_reader.CRCValidationError. This is not cosmetic: CRCValidationError subclasses ValueError, not McapError, so without this branch a payload-damaged source would silently fall through to IngestFailureKind.INFRASTRUCTURE — blaming the platform for a bad recording. It classifies to the same SOURCE_UNREADABLE kind as the not-MCAP case; error_type (InvalidMagic vs CRCValidationError) already stays stored verbatim beside the classification, so the two stay distinguishable in the ledger without a new IngestFailureKind member.

Cost

The transcode already decodes every chunk over one full read (reader.iter_batches()), so validate_crcs=True checks a CRC on a pass that was already happening rather than adding one. Measured directly on ingest-scale sources (not inherited from #429's smaller fixture number):

Source size	validate_crcs=False	validate_crcs=True	Ratio
30 MB (2 cameras, 120s, 640x480 @ 15Hz)	269.7 ms	300.1 ms	1.113x
75 MB (2 cameras, 300s, 640x480 @ 15Hz)	783.3 ms	810.7 ms	1.035x

Best-of-5 wall time, filesystem cache warmed identically before each series.

Tests

• tests/test_ingest_ledger.py::test_classify_crc_validation_error_as_source_unreadable — pins the classifier branch directly.
• tests/test_ingest_ledger.py::test_ingest_refuses_a_source_with_a_damaged_chunk_payload — a source with a damaged chunk payload (via the shared flip_chunk_payload_bytes fixture from fix(import): CRC-validate reused landing episodes before stamping receipts #429) raises through write_canonical_episode and produces no output file.
• tests/test_ingest_in_process.py::test_a_payload_damaged_source_is_classified_the_same_as_unreadable — end-to-end through hflow ingest: ledger row lands with failure_kind = source-unreadable, error_type = CRCValidationError.
• The existing not-an-MCAP tests (InvalidMagic → source-unreadable) are unchanged and still pass, confirming the structurally-invalid case keeps its current classification.

Validation

uv sync --locked --all-extras
uv run ruff check                 # clean
uv run ruff format --check        # clean
uv run ty check                   # clean
uv run pytest -q                  # 1623 passed, 6 skipped

[github-actions]

👋 Hi @Sravan1011 — thank you so much for your first contribution to HFlow!

A maintainer will review your pull request as soon as possible. In the meantime:

• ⭐ Star the repo: https://github.com/Hebbian-Robotics/hflow
• 💬 Join our Discord: https://discord.gg/vacepQvjmg
• 📖 Check CONTRIBUTING.md for the validation commands CI will run
• 📣 Share the project with your network

💡 Tip: one open pull request per contributor at a time. Issues with an assignee are taken; everything else is fair game.

We are excited to have you here and appreciate your help making the project better! 🙌

[kstonekuan]

LGTM, merging.

Checked the MRO rather than taking it: CRCValidationError subclasses ValueError, not McapError, so the classification branch is needed rather than defensive.