feat: partial extraction reporting and --atomic flag (#89)

[bug-ops]

Summary

• Add ExtractionError::PartialExtraction { source, report } variant that wraps the original error with an ExtractionReport snapshot captured at point of failure. TAR, ZIP, and 7z extractors now wrap mid-extraction errors in this variant when at least one file was written before the error.
• Add --atomic CLI flag: extracts to a temporary directory in the same parent as the destination, renames on success, and uses TempDir RAII drop for cleanup on failure.
• JSON error output includes a partial_report field; human-readable output shows a warning with the count of files written before the error.

Changes

• ExtractionOptions { atomic: bool } + extract_archive_with_options() / extract_archive_full() public API
• Move tempfile from dev-dependencies to dependencies in exarch-core
• Remove const from is_security_violation() and is_recoverable() to allow delegation through Box<ExtractionError>
• Python and Node binding error converters updated with exhaustive PartialExtraction match arms

Known follow-ups (non-blocking)

• 7z extractor reports 0 items written in PartialExtraction (callback API limitation) — filed separately
• Binding error converters discard the partial report; bindings will surface it when ExtractionOptions is exposed — deferred to binding PR
• --force + --atomic: existing destination is removed before extraction starts (documented in help text); true post-extraction removal deferred

Test plan

• cargo +nightly fmt --all -- --check passes
• cargo clippy --all-targets --all-features --workspace -- -D warnings passes (0 warnings)
• cargo nextest run --workspace --all-features --exclude exarch-python --exclude exarch-node --lib --bins — 542 passed, 0 failed
• cargo deny check clean
• Manual smoke test: exarch extract --max-file-size 500 two-files.zip /tmp/out/ — warning appears with file count
• Manual smoke test: exarch extract --atomic archive.tar.gz /tmp/out/ — temp dir cleaned on failure

Closes #89

[bug-ops]

Failing test: test_per_entry_encrypted_check_catches_missed_by_sampling

The test at crates/exarch-core/src/formats/zip.rs:1544 fails on all platforms because PR #105 introduces PartialExtraction wrapping for mid-extraction errors.

Root cause: With a 400-entry archive and the encrypted entry at index 125, extraction writes 125 plain files before hitting the encrypted entry. The new PartialExtraction variant wraps the error:

PartialExtraction {
    source: SecurityViolation { reason: "archive is password-protected..." },
    report: ExtractionReport { files_extracted: 125, ... }
}

The test asserts matches!(err, ExtractionError::SecurityViolation { .. }) — which no longer matches because the error is now wrapped.

Fix: Update the assertion to accept both forms:

assert!(
    matches!(
        &err,
        ExtractionError::SecurityViolation { .. }
            | ExtractionError::PartialExtraction { source, .. }
            if matches!(source.as_ref(), ExtractionError::SecurityViolation { .. })
    ),
    "per-entry check must catch encrypted entry missed by sampling, got: {err:?}"
);

Or alternatively, unwrap the inner source before asserting:

let root = match &err {
    ExtractionError::PartialExtraction { source, .. } => source.as_ref(),
    other => other,
};
assert!(
    matches!(root, ExtractionError::SecurityViolation { .. }),
    "per-entry check must catch encrypted entry missed by sampling, got: {err:?}"
);

This is the only failing test. Everything else on the PR passes.

[bug-ops]

Failing test: test_per_entry_encrypted_check_catches_missed_by_sampling

The test at crates/exarch-core/src/formats/zip.rs:1544 fails on all platforms because PR #105 introduces PartialExtraction wrapping for mid-extraction errors.

Root cause: With a 400-entry archive and the encrypted entry at index 125, extraction writes 125 plain files before hitting the encrypted entry. The new PartialExtraction variant now wraps the error:

PartialExtraction {
    source: SecurityViolation { reason: "archive is password-protected..." },
    report: ExtractionReport { files_extracted: 125, ... }
}

The test asserts matches!(err, ExtractionError::SecurityViolation { .. }) — which no longer matches.

Fix: Unwrap the inner source before asserting:

let root = match &err {
    ExtractionError::PartialExtraction { source, .. } => source.as_ref(),
    other => other,
};
assert!(
    matches!(root, ExtractionError::SecurityViolation { .. }),
    "per-entry check must catch encrypted entry missed by sampling, got: {err:?}"
);

This is the only failing test; everything else passes.