How can I be sure this project isn't sponsored by XYZ government secret agency and that more than 1GB of data does not contain any surveillance software?
you can't. but here are some reasons XYZ should not target Tails specifically :
- People who use Tails are not interesting data collection targets
- They have already access to people using Tails by other means
- It's just Linux. So their 0days could work with little effort in case they need it.
- The main purpose of Tor being an opensource project is plausible deniability for CIA agents using it. The main purpose of Tails (which is really a UX focused project) is more plausible deniability. They wouldn't ruin it by making a different "clean" version for their agents.