fix(cli): reject unsafe plugin archive links

[RerankerGuo]

Summary

• reject symbolic links, hard links, and special-file members before extracting plugin tarballs
• add a CLI regression that attempts a real symlink-based write outside the extraction directory

Root cause

_safe_extract_tar validated every member path before calling extractall, but a link member can change how a later, otherwise valid member path resolves during extraction. A crafted plugin package could therefore write outside the temporary extraction directory.

The plugin package contract only needs regular files and directories, so rejecting all other member types closes this path without changing normal TeamHarness packages.

Validation

• New regression on origin/main: fails after creating outside/pwned.txt
• New regression on this branch: passes and leaves the outside path untouched
• Existing unaffected CLI package/install/update/uninstall paths: 5/5 pass
• Full CLI suite with the non-overlapping fix(teamharness): align QwenPaw and AgentSpec contracts #1035 assertion correction applied: 6/6 pass
• Production module compiles with Python 3.8 and Python 3.11
• git apply --check confirms fix(teamharness): align QwenPaw and AgentSpec contracts #1035 remains independently applicable
• git diff --check

[shiyiyue1102]

LGTM. The extraction guard now rejects symlinks, hard links, and special-file members before tar extraction, and the regression test covers the symlink escape path. The scoped required check is green.