fix: address CodeQL archive and allocation findings

[aledbf]

Summary

• avoid the potentially overflowing capacity sum when merging cache-from values
• validate tar entry names as local platform paths before extraction
• confine Feature archive filesystem operations with os.Root, including symlink traversal protection
• strengthen cache merge aliasing coverage and add a symlink-escape regression test

Validation

• PASS: go test ./internal/cli -run Test(CacheFromForDockerfileBuild|ExtractTarGz) -count=1
• PASS: task lint
• PASS: internal/cli under task test:race
• NOTE: the complete task test:race run reached an unrelated existing failure in internal/oci/TestResolveBuildAuthFromOCIEnvAndGitHubToken because the local Docker credential store overrides its fixture token
• NOTE: an unfiltered internal/cli run reached unrelated parity failures caused by the local TypeScript oracle, including a missing pty.node native module