Function VerifyBundleArchive

Strictly validates a .mjdiag ZIP archive:

1. Verifies ZIP magic bytes (PK\x03\x04) and Central Directory integrity
2. Enforces path safety (no .., leading /, \, or symlink attributes) -> UNSAFE_ENTRY_PATH
3. Enforces canonical filename allowlist (IsAllowedMjdiagEntryPath) -> DISALLOWED_ENTRY_NAME
4. Enforces Zip-Bomb protections (maxCompressionRatio <= 25, maxUncompressedBytes <= 100 MiB, maxEntries <= 128); each entry inflates to at most its declared uncompressed size
5. Requires each local file header to repeat its central directory name, method, CRC-32 and sizes -> CORRUPT_ZIP_STRUCTURE
6. Parses and validates manifest.json (schemaVersion === '1.0', well-formed file descriptors) -> INVALID_MANIFEST_SCHEMA
7. Refuses any entry other than manifest.json that the manifest does not list -> UNLISTED_ENTRY
8. Recomputes SHA-256 of every file in manifest.files and verifies exact match -> ENTRY_SHA256_MISMATCH