zip container read/write, format detection, and recursive walking with depth and size guards

[Mearman]

Implements the package this repo was created for (documents.js#564): ZIP container read/write over fflate, archive-format detection, and the recursive ZIP-in-ZIP walker with zip-bomb guards.

• zipPackage/unzipPackage (src/zip/container.ts): ordered-entries write control with stored-uncompressed support, mirroring odf.js's container contract structurally (deliberately not importing it, keeping branding and release cadences decoupled).
• detectArchiveFormat/isZipArchive (src/zip/detect.ts): ZIP vs unknown from leading magic bytes (local-file-header or end-of-central-directory). tar and gzip are explicitly out of scope for v1.
• walkArchive (src/zip/walk.ts): detects ZIP-in-ZIP entries, walks recursively, and returns a flat listing with each entry's path-as-ancestor-chain. Two guards, both throwing rather than truncating: MAX_WALK_DEPTH (8, derived from what real producers emit - OOXML embedded objects bottom out at depth 2, J2EE packaging around 3) and MAX_WALK_TOTAL_BYTES (512 MiB cumulative across every nesting level - the same figure byte-codec grants a single stream, so a bomb's multiplicative nesting leverage becomes bounded addition). Each constant's derivation is in its source comment.
• Toolchain mirrors byte-codec exactly (turbo-wrapped scripts, tsdown neutral platform, eslint Worker-isomorphism guard + local/no-non-barrel-index, husky/commitlint, semantic-release with the commitTypes single source of truth, workerd test suite). CI is byte-codec's minus the notify-downstream job (no family package depends on archive-codec yet - the receiving automation would force-add an unused dependency) and minus the alias-publish matrix (no aliases yet).

Closes ExaDev/documents.js#564

Generated by Claude Code

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀