Port Bun Archive extraction path safety

Parent tracking: #202 and #66.

Home diverges from the current /Users/chris/Code/bun Archive implementation and corpus in two security-sensitive extraction cases:

• GNU longname entries longer than the fixed OS path buffer are normalized without an upfront bounds guard and can abort or hang the child process;
• a normalized pathname whose component stack climbs above the extraction root can reach mkdirat/createFile relative to dir_fd and create entries outside the requested directory.

The upstream archive fixture in packages/runtime/upstream is also one test behind the pinned Bun checkout.

Acceptance criteria:

• Port the current Bun overlong-path guard into the real Zig libarchive extractor.
• Reject only relative component paths that actually climb above the extraction root while allowing safe forms such as a/../b.
• Add focused unit coverage for the containment predicate.
• Sync the upstream archive test byte-for-byte from the pinned Bun checkout.
• Remove Archive’s fixture-specific blanket using/await using rewrite and rely on shared resource-management lowering.
• Match pinned Bun in Debug and ReleaseSafe, strict and routed modes: 101 pass, 1 platform skip, 0 fail, 10,473 expect calls.
• Do not weaken fixtures, assertions, deadlines, or workloads.

Completed in 54eabc0.

Ported two real extraction guards into Home’s Zig libarchive path: overlong GNU longname entries are skipped before the fixed OS path buffer is used, and relative component stacks that climb above the extraction root are rejected before filesystem *at calls. Safe normalization such as a/../b remains allowed. Added focused unit coverage, synced the upstream Archive fixture byte-for-byte from pinned Bun, and removed the fixture-specific blanket using/await using rewrite.

Final validation:

• pinned Bun: 101 pass, 1 skip, 0 fail, 10,473 expect calls
• Home Debug strict: 101 pass, 1 skip, 0 fail, 10,473 expect calls
• Home Debug routed: 101 pass, 1 skip, 0 fail, 10,473 expect calls
• Home ReleaseSafe strict: 101 pass, 1 skip, 0 fail, 10,473 expect calls
• Home ReleaseSafe routed: 101 pass, 1 skip, 0 fail, 10,473 expect calls
• runtime units: 1,822 passed, 19 skipped, 0 failed
• adjacent symlink traversal suite: six consecutive green Debug/ReleaseSafe reruns at 3/3
• upstream Archive fixture SHA-256: c1af33ac9b5d38546815da2d8ca048545b98ba71834d6a05d000defe701f9da1, identical to /Users/chris/Code/bun
• Debug and ReleaseSafe builds succeeded; no assertion, deadline, or workload weakening; no heap snapshots