v1: enforce artifact bounds during transfer and validate restore archives

[hallerite]

Context

Post-merge review of #2144 found two trust-boundary gaps in the grading-artifact transport now on main:

1. _tar_out() checks wc -c in the sandbox, then performs a later unbounded runtime.read(). An agent-controlled process can replace or grow the archive between those operations, bypassing MAX_ARTIFACT_BYTES during the actual host transfer.
2. restore() extracts the transported tar at / without validating members against the declared artifact root. An agent that races or replaces the archive (or replaces tooling in its sandbox) can introduce absolute/parent-traversal members, escaping the declared path in the grading sandbox.

This is related to the broader artifact archival/transport contract in #2189, but it is the narrower security boundary: the transport must remain bounded and must not restore outside each declared root.

Suggested direction

• Use the runtime's bounded-read primitive during the transfer itself, with the remaining per-rollout budget.
• Validate every member before upload/restore: reject absolute paths, .. traversal, entries outside the declared root, escaping symlink/hardlink targets, and unsafe special-file types.
• Keep validation and extraction ordering atomic from the host's perspective; reject before clearing/restoring roots.
• Add focused coverage for archive replacement/growth, traversal, escaping links, and valid nested files.

Done when

• MAX_ARTIFACT_BYTES cannot be bypassed by replacing or growing the sandbox archive after a size probe.
• Restored members and links cannot escape the corresponding declared artifact root.
• The behavior is documented alongside the artifact threat model and v1: model Harbor artifacts as durable outputs, not only grading transport #2189's longer-term storage design.

Found in the Macroscope review thread on #2152 after #2144 had already merged.