Harden source archive extraction on older Python releases

[ryanduguid]

Summary

• validate the complete source TAR before extraction
• permit only directories and regular files beneath the exact expected source root
• reject traversal, absolute and non-portable paths, links, devices, duplicates and case collisions
• replace the unfiltered compatibility fallback with bounded manual extraction
• add adversarial tests for the filtered and Python 3.10 fallback paths

Root cause

The release helper used extractall(filter="data") where supported, but caught TypeError on older supported Python patch releases and retried with unfiltered extractall. The earlier name check covered absolute and parent-traversal paths but did not make that fallback safe for links, special files, collisions or platform-specific path forms.

Impact

Safe source archives continue to extract beneath the expected root. Unsupported or ambiguous members now stop release verification before extraction. The fallback creates only directories and regular files with exclusive creation, extracted-size checks and sanitised modes.

Validation

• 14 focused extraction tests passed, covering filtered and forced-manual paths
• complete suite on CPython 3.10.20: 495 passed
• complete suite on CPython 3.12.10: 495 passed
• Bandit 1.8.6 over paydaysuper and tools: zero medium and zero high findings; B202 removed
• git diff --check: passed