security(archive): use p.isWithin() instead of startsWith for zip extraction path bounds

[ZhuchkaTriplesix]

Summary

Zip extraction in three places validates output paths with:

if (!targetPath.startsWith(root)) { ... }

without ensuring root ends with a path separator. The .. substring check catches most traversal attempts, but package:path provides p.isWithin(base, path) for correct boundary checks (e.g. /tmp/abc vs /tmp/abcd edge cases on some platforms).

Affected code

• lib/core/market/http_marketplace_repository.dart (~line 160)
• lib/core/extensions/local_extension_installer.dart (~line 229)
• lib/core/updater/installers/update_install_utils.dart (~line 31)

Proposed fix

Replace startsWith(root) checks with p.isWithin(root, targetPath) (or equivalent helper with trailing separator). Add regression test for prefix-boundary case if feasible on CI OS.

Acceptance criteria

• All three extractors use isWithin (or shared helper).
• Existing path traversal tests still pass.
• Optional: test for sibling-prefix edge case.

Severity

Low — defense-in-depth; primary .. guard likely sufficient today.

Related

• Closed security(extensions): защита от Path Traversal при распаковке архивов тем и плагинов #242 (path traversal)
• Security review 0.4.11
• security(archive): zip bomb limits and bounded decompression for extension/updater installs #398 (zip limits — can land in same PR or separate)