Support bounded remote and archive import sources

[alexschmander]

Problem

Import accepts local staged sources only; operators cannot safely acquire remote URLs or archives through the import lifecycle.

Current behavior

Remote fetch and archive extraction are unsupported to avoid authentication leakage, SSRF, traversal, decompression bombs, and unbounded resource use.

Desired behavior

Add explicit authenticated remote and archive source types with bounded acquisition, traversal-safe extraction, durable checkpoints, and provenance.

Acceptance criteria

• Define supported protocols/archive formats, authentication references, redirects, DNS/IP policy, TLS, timeouts, and allowlists.
• Never place credentials in URLs, logs, commands, persisted public records, or diagnostics.
• Bound compressed/uncompressed bytes, entry counts, path lengths, ratios, downloads, retries, and concurrency.
• Reject absolute/traversal/symlink/hardlink/device paths and verify extracted sources before planning.
• Support cancellation/restart/cleanup and test SSRF, rebinding, archive bombs, duplicates, partial downloads, and redaction.

Scope

Import source acquisition only; existing format parsing/build/publication remains authoritative downstream.

Implementation notes

Credentials require a separate secret-reference contract and private control-state handling.

Tracking source

docs/tracking/feature-requests.md:45

Remote and archive import sources with bounded, authenticated, traversal-safe acquisition.