Just taking down notes for now, will investigate deeper later:
So @Smalyshev figured out that TE:chunked isn't actually a problem for our varnish3, it's just a problem for our misc-web VCL (thanks!). We need to fix it for WDQS, since their output is always chunked.
The std.integer() wrappers on the Content-Length checks makes them succeed for chunked responses which have no Content-Length. This is the actual problem we had in the 15.wikipedia.org issue we blamed on TE:chunked as well.
One of the reasons for a size-based hit_for_pass limit in cache_misc historically was that it was a small memory-only cluster. It's now a proper cluster, but some of the frontends still have relatively small RAM, so we can't just bump the memory storage size universally either. What we could do is only apply the size limit on frontends, though, and let backend disk hits take the larger objects. Doing that in turn will of course break the cache_local_random thing for passes, so it may need disabling on the frontends like cache_upload, although really we should find a better way to deal with that problem (e.g. by marking layer-differential passes for special treatment, so that other passes can still randomize).