Add artifact malware quarantine guard

[KoiosSG]

/claim #14

Summary

• Adds a self-contained artifact-malware-quarantine-guard/ slice for Scientific/Engineering Data & Code Hosting issue Scientific/Engineering Data & Code Hosting #14.
• Evaluates hosted uploads before preview, reproduce-run, API access, or export using synthetic scan evidence, checksums, archive shape, archive path traversal, macro/model/notebook risk, and scan freshness.
• Emits deterministic JSON, Markdown, SVG, and MP4 reviewer artifacts with SHA-256 audit digests.

Scope

This focuses specifically on malware, archive-bomb, archive path traversal, macro-enabled spreadsheet, unsafe model deserialization, embedded notebook script, denylisted checksum, and stale-scan gates before hosted artifacts are released.

It is distinct from the existing FAIR manifest/access, artifact package integrity, preview cache, raw/notebook preview, retention/tombstone, model-card lineage, license compatibility, sensitive-redaction, schema-evolution, data-dictionary, persistent-ID, SBOM, upload checkpoint, replica consistency, and column-sensitivity slices.

Hardening update

• Added ZIP Slip-style archive path traversal quarantine coverage for parent-directory, absolute, drive-rooted, UNC, and null-byte archive entries.

Validation

• cd artifact-malware-quarantine-guard && npm run check -> passed
• cd artifact-malware-quarantine-guard && npm test -> artifact-malware-quarantine-guard tests passed (4)
• cd artifact-malware-quarantine-guard && npm run demo -> generated JSON/Markdown/SVG artifacts
• cd artifact-malware-quarantine-guard && npm run demo:video -> generated reports/demo.mp4
• ffprobe confirmed reports/demo.mp4 is H.264, 1280x720, 7.5s, 24fps
• git diff --check -> passed
• rg -n "(password|secret|wallet|paypal|bank|passport|private key|api key)" artifact-malware-quarantine-guard -> no matches

Safety

Synthetic data only. No credentials, private research files, network calls, live malware scanner calls, storage mutations, payment processor calls, or private dashboard data are included.

AI-assisted with OpenAI Codex; I reviewed and locally verified the diff before submitting.

[KoiosSG]

Hardening update pushed in c350c45: added ZIP Slip-style archive path traversal quarantine coverage for parent-directory, absolute, drive-rooted, UNC, and null-byte archive entries. Validation refreshed locally: npm run check, npm test (4 tests), npm run demo, npm run demo:video, ffprobe on reports/demo.mp4, git diff --check, and a sensitive-term scan with no matches.