Installing a plugin no longer needs unzip or tar on PATH, and entry paths
are vetted in Lua instead of trusting an external tool.
Add arti-pack.archive: a zip reader over zzlib's inflate and a tar reader
over its gunzip.
Reject absolute, parent-walking, backslashed and NUL-bearing entry names,
and any entry that is not a regular file or directory.
Verify every zip entry's CRC32 and size, and fail the install on mismatch.
Carry only the executable bit from archive modes.
Replace fs.extract_cmd with fs.extract and call it synchronously.
Drop unzip from the test pipeline and the stated requirements.
Add zzlib (codeberg.org/zerkman/zzlib @ 9c39321, WTFPL) under
lua/arti-pack/vendor. Namespace its submodule requires and re-export
crc32; the inflate backends are unmodified.
Exclude the vendor directory from luacheck and stylua.
unkin-agent