fix(security): prevent path traversal in TerminalBench 2 tar extraction

[Junass1]

This PR closes a quiet but dangerous gap in TB2 archive handling

Some bugs scream. This one didn’t.

TerminalBench 2 evaluation accepted base64-encoded tar.gz archives from dataset task payloads and extracted them into temporary directories. Until now, that extraction path trusted archive metadata too much.

That meant a malicious archive could attempt to:

• escape the intended extraction root with traversal paths
• introduce unsafe non-file members such as symlinks
• write unexpected content outside the task’s temp workspace during eval setup

What changed

The extraction flow was hardened to treat archive contents as hostile input.

This PR:

• rejects absolute paths
• rejects Windows drive-prefixed paths
• rejects .. traversal segments
• rejects non-regular-file archive members
• performs bounded manual extraction instead of trusting extractall()

In short: task archives can still populate the eval workspace, but they can no longer redefine where that workspace ends.

Why this matters

TB2 tasks are effectively untrusted content at the archive boundary.

Even though this happens in an evaluation pipeline, archive traversal here is still high impact:

• it can contaminate the local machine or runner state
• it can interfere with neighboring tasks
• it weakens confidence in benchmark isolation
• it creates an avoidable file-write primitive in a code path that should be deterministic

Proof we locked it down

Added focused security tests covering:

• valid nested file extraction
• traversal rejection
• symlink member rejection

How to test

python -m pytest tests/environments/benchmarks/test_terminalbench2_env_security.py -q

[teknium1]

Merged via #5944 as part of a consolidated security hardening PR. Your tar traversal fix and security tests were applied as-is — thorough CVE-2007-4559 mitigation. Thanks @Awsh1!