feat: audit stale incomplete downloads

[seonghobae]

Summary

• add a bounded read-only Rust audit for .crdownload files
• reuse existing embedded ZIP/acquisition probes and active-use evidence
• add 16 KiB magic-byte type detection, modified-age review buckets, final-sibling checks, path-redacted fingerprints, and create-new mode-0600 private evidence
• preserve exact ZIP carve ranges privately while exposing only bounded recovery totals
• centralize secure private JSON writing and keep the existing multipart CLI behavior

Metadata semantics

• download acquisition time is context, not production time
• filename dates are not used as production evidence
• filesystem modified time is used only as a staleness signal
• magic type and ZIP structure never authorize automatic discard

Live read-only evidence

• 8 incomplete downloads, 763,935,577 logical bytes
• 0 active and 0 incomplete active-use observations
• 2 recent idle and 6 stale idle at the default 30-day threshold
• 6 recovery candidates; 3 items contain structurally bounded ZIP ranges totaling 117,732,855 bytes
• 1 whole-file ZIP structural candidate (50,742 bytes), still requiring CRC/content validation
• acquisition-date evidence 8, production-time evidence 0
• evidence complete, issue count 0, mutation false
• audit fingerprint reproduced: 45af42dc25e0e4a93df4a95692fee744266c248696e7a1e30210bf3a0949f9ca

Verification

• incomplete-download/library tests: 11 passed
• secure private-evidence test: 1 passed
• new CLI tests: 2 passed
• multipart CLI regression tests: 3 passed
• cargo check --features cloud-cli --all-targets
• focused rustfmt and git diff --check
• CodeGraph synced and call paths reviewed

Stack

Draft and stacked on #90 (feat/multipart-archive-set-audit).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 41e93cba-6fc6-43a3-beb6-a9be7b735ec7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}