Promote the xz codec with a restricted single-stream ustar wrapper

[blisspixel]

Summary

The second Gate B codec promotion: the explicitly selected sealr.profile.tar-xz.ustar-portable.v1 xz-wrapped portable ustar profile under policy v9, executed for lzma-rust2 0.20.0 (std+xz features only, forbid(unsafe_code) under the selected features, Apache-2.0, exactly +1 runtime package on every release target).

• Restricted language: exactly one XZ stream of 1..=4096 LZMA2-only blocks (multi-block is required language — stock xz 5.4+ defaults to multithreaded compression); 8 MiB dictionary ceiling enforced from the properties byte before decoder allocation, with the decoder's 8256 KiB memory limit as an independent second wall; CRC32/CRC64/SHA-256 checks verified twice (decoder while streaming, Sealr's own implementations over the final derived bytes) with check None denied; declared block sizes both-or-neither and verified; reserved bits zero; stream padding, concatenation, and trailing bytes rejected with exact full-source consumption.
• Dual-parse containment: lzma-rust2 parses the container while streaming; Sealr independently parses footer-and-index first over the decoder-established consumed range and re-verifies every header CRC32 plus the index tiling, backward size, and reserved bits the upstream decoder does not enforce on its own. Any disagreement fails closed as an integrity finding.
• Evidence and identities: sealr.archive-ir.tar-xz-ustar.v1 wrapper evidence; sealrTreeV10 under sealr.tree.layout.tar-xz-ustar.v1; the format-neutral sealrTreeV1 content root shared across raw, gzip, zstd, and xz encodings (cross-wrapper parity asserted against both committed manifests); policy v9 (sealr:policy/default/v9) authorizing tar-xz-ustar; explicit selection through TarXzInterpretationProfile::UstarPortableV1 and --format tar-xz-ustar; fail-closed worker refusal.
• Evidence surfaces: sealr.tar-xz-identity-conformance.v1 vectors from pinned XZ Utils 5.8.1 producer bytes (default CRC64, multi-block, SHA-256, CRC32) plus a handcrafted uncompressed-LZMA2 stream; independent verifier reconstruction with self-contained CRC32/CRC64/SHA-256 and mutation rejection (55 verifier tests); a 17-seed bounded fuzz campaign registered across the seed-manifest, workflow, and release contracts (12 campaigns total); CLI contract, packaged consumer, crate-package contract, per-target dependency contract (+1 lzma_rust2 on all three floors), and regenerated third-party license bundles; new codec.xz.invalid_stream and codec.xz.trailing_input finding codes.

Test plan

• cargo test --locked --workspace (406 sealr lib tests; 6/6 tar_xz_public_api with the pinned sealrTreeV10 triple)
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings, cargo fmt --all -- --check, rustdoc -D warnings
• cargo deny check; verify_docs.ps1 (75 finding codes); verify_dependency_budget.ps1; verify_third_party_licenses.ps1; verify_crate_package.ps1; verify_fuzz_seeds.ps1 (12 campaigns, 17 TAR/xz seeds)
• cargo test --locked -p sealr-identity-verifier (55 tests) and both manifest CLI runs