feat(diagnostics): retrieve encrypted inspect archives

[cxymds]

Related Issues

Closes rustfs/backlog#1497

Related: rustfs/backlog#1401, rustfs/backlog#1383, rustfs/backlog#1361

Summary of Changes

• Add rc admin diagnostics inspect-archive ALIAS/BUCKET/OBJECT --output FILE.
• Discover and strictly validate the RustFS v4 inspect-archive capability before invoking the route.
• Generate a fresh ephemeral 2048-bit RSA key by default, or accept a protected PKCS#8 RSA private-key file.
• Stream the encrypted response into private bounded staging storage, then locally unwrap, authenticate, decrypt, validate the tar manifest, and atomically publish only verified plaintext.
• Enforce the RustFS #5207 v1 contract: route, media type, RSA-OAEP-SHA256 + AES-256-GCM chunk framing, authenticated final digest, and advertised limits.
• Preserve stable JSON v3 success/error output without exposing private keys, archive contents, or target identifiers.

Security and Reliability

• Capability-gated fail-closed behavior for unsupported, disabled, permission-denied, and incompatible servers.
• 16 MiB ciphertext/plaintext ceiling, advertised timeout and per-drive metadata bounds, bounded manifest parsing, and no whole-response buffering.
• PKCS#8 private-key files must be regular non-symlink files with no group/other permission bits; key input and AES data keys use zeroizing storage.
• Temporary encrypted/plaintext files are mode 0600 on Unix and are cleaned up on verification failure or cancellation.
• Output publication uses persist_noclobber; existing and symlink destinations are rejected, including nested output-directory symlink components.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace -- -D warnings
• cargo test -p rc-core inspect_archive -- --nocapture (6 passed)
• cargo test -p rc-s3 inspect_archive -- --nocapture (4 passed)
• cargo test -p rustfs-cli inspect_archive -- --nocapture (7 tests in each CLI binary)
• cargo test --workspace (all workspace unit, integration, schema, help-contract, and doc tests passed)

Adversarial review verdicts:

• Security: PASS
• Correctness: PASS
• Concurrency/cancellation: PASS
• Performance/resource bounds: PASS
• API compatibility: PASS
• Test quality: PASS
• Operations/observability: PASS

Compatibility

This is an opt-in command for RustFS servers advertising admin.diagnostics.inspect-archive. Older RustFS and non-RustFS aliases fail with an actionable capability error before a route request. Existing inspection commands and legacy v3 inspect behavior remain unchanged.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md). If this is your first contribution, review the CLA document and sign it by commenting I have read and agree to the CLA. on the PR.