Harden ZIP cache and report path hygiene

[svy04]

Summary

• Harden plugin ZIP creation so file contents and mode are read from the same opened file descriptor before writing cache entries.
• Teach generated public-report sanitization to scrub the current repo root before broader user-home fallbacks, including worktree paths with private/local workspace names.
• Extend public artifact hygiene write mode with the same current-root scrub so accidental local-path report output can be repaired before check mode.

Verification

• bun test src\utils\plugins\zipCache.test.ts scripts\product-report-sanitizer.test.ts scripts\public-artifact-hygiene.test.ts scripts\public-repo-readiness.test.ts
• bun run typecheck --pretty false
• git diff --check
• bun run product:quality
• bun run verify:privacy

Boundaries

• product:quality passed locally and still records local/protected environment boundaries without turning them into readiness claims.
• Generated product-quality report churn from the local run is intentionally not included in this PR.