[0.5] Expand the synthetic ZIP security regression corpus

[SetraTheXX]

Context

The inspector has cross-platform path safety and metadata hardening, but the
public test corpus should make every high-impact rule easy to reproduce.

Goal

Add small, synthetic fixtures and focused tests for the documented security
signals without committing real malicious archives.

Acceptance criteria

• Cover traversal and mixed separators.
• Cover duplicate names and normalized, case-insensitive, and Unicode path
  collisions.
• Cover symlink metadata, encrypted entries, unsupported methods, corrupt
  structure, and resource limits.
• Assert deterministic risk flags, severity, and extraction behavior.
• Keep fixtures small, generated, and safe to store in the public repository.
• Run the relevant tests on Windows and Linux in CI.

Non-goals

• Publishing exploit archives.
• Adding a new archive format.
• Making a universal security guarantee.