tests: Harden archive, storage, and installer I/O boundaries

[nishantmonu51]

Harden destructive and untrusted I/O paths and add focused failure-path coverage.

• validate archive paths and entry types before extraction
• bound extracted entry sizes and reject truncated archives
• stage archive replacement so failed downloads preserve the existing project
• reject storage prefix traversal and preserve local/bucket error semantics
• clean temporary storage after constructor failures
• reject installer HTTP errors, cross-host redirects, oversized/truncated bodies, and non-zero script exits
• propagate cancellation and always remove downloaded scripts

Validation:

• go test -race -count=1 ./runtime/pkg/archive ./runtime/storage ./cli/pkg/installscript

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. No documentation update is required.
• Intend to cherry-pick into the release branch
• I am proud of this work!