Default baseline scanner when no external AV or cloud bucket scanner is configured.
Relies on the preceding cryptographic AEAD check and strict VerifyBundleArchive()
structural checks (canonical filename allowlist, no path traversal/symlinks,
compression ratio <= 25:1, and SHA-256 per-entry verification).
Default baseline scanner when no external AV or cloud bucket scanner is configured. Relies on the preceding cryptographic AEAD check and strict VerifyBundleArchive() structural checks (canonical filename allowlist, no path traversal/symlinks, compression ratio <= 25:1, and SHA-256 per-entry verification).