Defensive hardening for artifact download and extraction

[GHOryy5]

Summary

This PR adds defensive hardening to the native binary installation flow without changing expected behavior for valid inputs.

Changes

• Add path validation during archive extraction to prevent traversal outside the target directory
• Apply timeouts to external network downloads to avoid indefinite hangs
• Resolve external tool binaries defensively instead of assuming PATH integrity

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[GHOryy5]

I have read the CLA Document and I hereby sign the CLA

[etraut-openai]

Is there a bug report associated with this PR? We ask that all bug fixes have an associated bug report in our contribution guidelines. This helps us track and prioritize issues.

Is this addressing a real problem that you've seen, or does it address a theoretical issue?