[2026 Templates] Prevent archive path traversal during extraction

[Nanle-code]

Objective

Reject absolute paths, parent traversal, links, and files outside the destination root.

Target area

template download and extraction

Acceptance criteria

• The objective is implemented with clear handling for invalid input, unsupported environments, and failure paths.
• Automated tests cover the primary flow, at least one boundary case, and at least one failure case.
• User-facing documentation or developer guidance is updated, including compatibility, security, or migration notes where applicable.

Source: .github/roadmap-issues-2026-07-29.json.