Variacs have two limiting currents - the max. winding current and the max. wiper current. In the absence of manufaacturer's model specific rating data, all you can do is assume the two limits are the same. You can calculate the max winding current from the VA rating divided by the highest nominal input voltage, so for this Powerstat Type 1226, 2.5KVA, 230/115V, variac, that's 2500/230 = 10.87A. If you wire it using the 230V input tap (either for 230V in, 0 to 267V out, or for half-voltage operation 115V in, 0 to 133V out), the max. output current is the max. winding current. However if you wire it for 115V in, boosted to 0 to 267V out, above 230V (double the input voltage) you have to derate it linearly by 1 / (boost_ratio - 1) to keep the current in the lower half of the winding below the input tap under the max. winding current. Therefore at the max. boost of x 2.32, the max output current is 10.87/1.32 = 8.23A.
Therefore you need to fuse the output at either 10A if using the 230V tap or 8A if using the 115V tap. In practice a resettable thermal circuit breaker makes more sense than a fuse, as it will be reasonably resistant to short term overload. If using it on a 230V circuit capable of more than 10A, the input should also be protected with a 10A slow-blow fuse or circuit breaker. When using the 115V in tap, it should have a 20A input fuse or circuit breaker. That's the same or more than the panel breaker rating for a normal U.S. domestic NEMA 5-15R, or NEMA 5-20R 115V outlet so can be omitted at the variac.
You've also got some metal-bashing or 3D printing to do to make up a terminal cover with cord grips unless you plan to panel mount it in a larger enclosure. Its chassis *must* be grounded.