fix(security): extract archives through an os.Root handle

[tas50]

Addresses the open go-path-traversal code scanning alerts (#10, #11, #12, #16, #21).

What the scanner found

Five alerts across the three tarball extractors:

Alert	Location
#10, #11, #12	cli/cookbook/extract.go (cookbook install)
#16	cli/policyfile/extract.go (policyfile cookbook fetch)
#21	cli/policyfile/rubyeval/loader.go (ruby.wasm loader)

Each site already guarded containment with filepath.Rel, which CodeQL does not model as a sanitizer. So the immediate question was whether these are real.

What is actually wrong

The guards are correct for what they check, and the existing ../ tests still pass. But the check is lexical: it reasons about the entry name as a string. An entry like nginx/cache/evil.rb is provably inside the destination by every string comparison available.

The write happens against the filesystem. If the destination already holds a cache symlink pointing elsewhere, the create follows it and the entry lands outside the directory that was just validated. The same gap covers the TOCTOU case, where a symlink appears between the check and the write.

Is it exploitable today?

No. All three destinations are freshly created directories (os.MkdirTemp, or RemoveAll followed by MkdirAll), so there is no pre-existing symlink to follow, and all three extractors skip symlink and hardlink entries, so a hostile archive cannot plant one mid-stream.

That safety rests entirely on an unwritten invariant: every caller must pass a fresh directory. Nothing in the extractors enforces it, and nothing warns a future caller who reuses a directory. This change removes the invariant rather than documenting it.

The change

Open the destination as an os.Root and route every MkdirAll and OpenFile through that handle. Containment is enforced per path component at open time, so an escape fails at the syscall no matter what the name looked like.

The lexical check stays: it still produces the better error message, naming the offending archive entry, and it rejects bad input before any I/O.

Tests

Each extractor gets a test that plants a symlink in the destination and asserts the entry does not escape through it. All three fail before this change:

--- FAIL: TestExtractArchiveDoesNotFollowSymlinkOutOfDest
    archive entry escaped destDir through a pre-existing symlink
--- FAIL: TestExtractCookbookTarballDoesNotFollowSymlinkOutOfDest
    archive entry escaped dest through a pre-existing symlink
--- FAIL: TestExtractTarGzDoesNotFollowSymlinkOutOfDest
    archive entry escaped dest through a pre-existing symlink

go build ./..., go vet ./..., and gofmt are clean. cli/cookbook, cli/policyfile, and cli/policyfile/rubyeval all pass, including the full rubyeval suite that exercises real ruby.wasm extraction through the changed path.

Not covered here

Two other path traversal alerts on the security tab are not addressed, because neither is a defect:

• Add cinc client create command #20 (ruby-path-traversal, critical) in cli/policyfile/rubyeval/generate_goldens.rb. A developer-only golden generator that is never compiled into the binary. The flagged File.read(policyfile_path) reads paths produced by Dir.glob over a fixed testdata directory, with no external input. Recommend dismissing as a false positive rather than contorting a dev script to satisfy the scanner.
• fix(policyfile): keep a repository source path inside the clone #183 already covers a genuine path traversal in cli/policyfile/fetch.go (a git source's path escaping the clone) and is unrelated to these.