core: SanitizedMode newtype and non_exhaustive on growth-prone enums

[bug-ops]

Summary

• Introduce a SanitizedMode newtype wrapping sanitized permission modes, sealed so it can only be constructed by sanitize_permissions. Threaded through ValidatedEntry, create_file_with_mode, and extract_file_with_permit, replacing an Option<u32> whose "must be sanitized" invariant was previously enforced only by a doc comment.
• Mark ArchiveError, QuotaResource, formats::detect::ArchiveType, formats::compression::CompressionCodec, inspection::report::IssueCategory, and types::entry_type::EntryType as #[non_exhaustive] so adding a variant to any of them is no longer a semver break for downstream exhaustive matches, consistent with the existing ValidatedEntryType precedent. creation::walker::EntryType was intentionally left unmarked — it is pub(crate)-only and never nameable outside this crate.
• Added wildcard arms to exhaustive matches on the now-non-exhaustive enums in exarch-cli, exarch-python, and exarch-node.
• Added a trybuild fixture proving SanitizedMode cannot be forged from outside sanitize_permissions, mirroring the existing QuotaPermit fixture.

Test plan

• cargo +nightly fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run --workspace --all-features --exclude exarch-python --exclude exarch-node (1229/1229 pass)
• cargo test --doc --workspace --all-features --exclude exarch-python --exclude exarch-node and cargo test --doc -p exarch-core without --all-features (119/119 pass both ways)
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features --workspace
• cargo audit / cargo deny check --all-features clean, no new unsafe
• Live-extracted forged-header TAR and ZIP archives to confirm setuid/setgid/world-writable stripping is unchanged (4755->0755, 2755->0755, 6755->0755, 7777->1775, 1755->1755, 0777->0775 across both formats)

Closes #549
Closes #551