fix(security): harden backup import and OOXML extraction

[zapabob]

Summary

• Bound backup ZIP member count, compressed size, expanded size, and compression ratio before extraction.
• Count directory entries, reject normalized-member collisions, validate archive link members, and stream the exact validated ZipInfo objects.
• Normalize the optional .hermes/ wrapper before external-state classification and confine restoration to declared provider roots.
• Bound DOCX and XLSX archive expansion in tools/read_extract.py.
• Preserve the upstream Tirith checksum fallback unchanged; this PR no longer changes Tirith provenance behavior.

Validation

• scripts/run_tests.sh tests/hermes_cli/test_backup.py tests/tools/test_read_extract.py -q
• git diff --check upstream/main...HEAD
• Diff against current upstream is restricted to backup import, OOXML extraction, and regression tests.

No fork-only plugins or _docs files are included.

[alt-glitch]

This was generated by AI during triage.

Related to #43942 (open — curator rollback tar symlink/abs-path hardening) and merged #50354 (same hermes_cli/backup.py, snapshot/manifest traversal guards). Not a duplicate: this adds zip-bomb / oversized-member bounds plus external-provider path confinement on the hermes import extraction path. Defense-in-depth hardening (operator supplies the archive) — out-of-scope of the OS-isolation security boundary per SECURITY.md §3.2.

[teknium1]

Thanks for the archive hardening work. The backup-import premise is live on current main: hermes_cli/backup.py:543-545 enumerates every ZIP member and :645-646 reads each member unbounded; DOCX/XLSX extraction likewise reads archive members without resource validation at tools/read_extract.py:109-110 and :135-149.

Problems

• tools/tirith_security.py:424 makes cosign mandatory for auto-install. This reverses intentional behavior from e3f9894c (“tirith cosign-free install”): current main deliberately proceeds with SHA-256 verification when cosign or its artifacts are unavailable (tools/tirith_security.py:424-451). The user-facing security documentation matches that contract (website/docs/user-guide/security.md:592). Requiring cosign removes the scanner for ordinary supported-platform auto-installs rather than hardening its existing behavior.

Suggested changes

• Keep the ZIP/OOXML resource limits and external-provider restore confinement, but drop the Tirith provenance behavior and its test rewrites. Retain the existing abort on an explicit cosign rejection while preserving the SHA-256 fallback for unavailable/broken provenance verification.

Automated hermes-sweeper review.

[zapabob]

Implemented the maintainer's requested contract correction.\n\n- Restored SHA-256 verification as the always-required integrity check.\n- Restored optional cosign provenance verification when cosign and its artifacts are available.\n- cosign absence, unavailable artifacts, and cosign execution failure fall back to SHA-256.\n- An explicit cosign verification rejection remains fail-closed.\n- Archive resource limits, member validation, and restore-target confinement remain unchanged.\n\nFocused verification: uv run pytest -q tests/tools/test_tirith_security.py passed (95 tests); Ruff passed for the changed files.

[zapabob]

Review follow-up is pushed. I removed the Tirith provenance change from the effective diff and preserved the upstream checksum fallback. The remaining change is limited to backup-import and OOXML extraction resource/path validation; the focused backup and extraction tests pass.