Validate archive entries and stage inside the pack root

- Reject archive members that are absolute, escape via .., are special files, or link outside the destination, before anything is written

- Stage under the pack root so the swap is a same-filesystem rename, with an EXDEV copy fallback; propagate registry auth errors and validate dir_name

tests/minimal.lua

@@ -65,6 +65,26 @@ _G.tmpdir = function()
   return dir
 end
 
+-- A writable directory on a filesystem other than `reference`, so the EXDEV
+-- paths can be exercised for real. nil when the box has no second mount.
+_G.otherfs_dir = function(reference)
+  local uv = vim.uv or vim.loop
+  local ref = uv.fs_stat(reference)
+  if not ref then
+    return nil
+  end
+  for _, base in ipairs({ '/dev/shm', '/run/user/' .. tostring(uv.getuid and uv.getuid() or 0), '/var/tmp', '/tmp' }) do
+    local stat = uv.fs_stat(base)
+    if stat and stat.dev ~= ref.dev then
+      local dir = vim.fs.joinpath(base, 'vimpack-xdev-' .. tostring(uv.hrtime()))
+      if vim.fn.mkdir(dir, 'p') == 1 then
+        return dir
+      end
+    end
+  end
+  return nil
+end
+
 local files = {}
 for i = 1, #_G.arg do
   files[#files + 1] = _G.arg[i]