Fix bounded trusted archive source limits

[chubes4]

Summary

• classify digest-pinned and canonical provider archives as a generic trusted source class with an explicit 10,000-entry cap
• preserve bounded download, aggregate expanded bytes, per-entry bytes, path, and compression-ratio validation through archive central-directory inspection
• add deterministic 5,001-entry admission and 5,002-entry rejection coverage

Fixes #2242.

Verification

• npm run build
• npm run test:zip-source-policy
• npm run test:recipe-extra-plugin-local-zip
• ./node_modules/.bin/tsx scripts/source-policy-smoke.ts
• Immutable fixture 20 completed WP Codebox import and package activation using the current official archive. The downstream SSI quality gate remains red because no static front page was configured; no fixture or downstream workaround was made.

AI assistance

OpenAI gpt-5.6-terra via OpenCode implemented the generic bounded archive-source policy, added deterministic archive-limit coverage, composed the #2241 dependency candidate, and ran focused plus immutable-fixture verification. Chris Huber remains responsible for every line.