ergasia: 3 low-severity audit findings (wave-1 batch)

[forkwright]

Findings

correctness

• crates/ergasia/src/session.rs:184 — delete_torrent maps its deletion failure to PauseAction error variant, masking the real operation (low)

security

• crates/ergasia/src/extract/zip_extract.rs:46 — ExtractedFile manifest paths built from raw zip entry name() bypass output-dir containment (low)
• crates/ergasia/src/extract/rar.rs:111 — RAR ExtractedFile manifest paths join raw unrar filename PathBuf without containment check (low)

Note

These are batched low/info findings; split any out if it gets prioritized.