Epoxide ring opening via decarboxylation
You are correct about protonating the epoxide of the glycidic acid 1 (by some other molecule of glycidic acid). Ring opening gives stable, tertiary cation 3 and NOT cation 6, which is destabilized by the carbonyl group. Collapse of 3 gives CO2 and the enol 4 which tautomerizes to the aldehyde 5.