fix(patch): reject POSIX-style absolute paths in archive entries on Windows

`read_archive_to_map` rejects entries whose path is absolute or contains
a `..` component, but the check used `Path::is_absolute()` alone. On
Windows that function requires a drive letter or UNC prefix, so a tar
entry like `/etc/passwd` is NOT considered absolute and would slip
through the guard — when later joined to the target directory, Windows
would treat it as relative to the current drive's root.

Add an explicit check for a leading `/` or `\` byte alongside
`Path::is_absolute()` so the guard rejects POSIX-style absolute paths
on every platform. The new test_read_archive_rejects_backslash_absolute_paths
case locks the symmetric backslash form in.

This was uncovered when the CI matrix was extended to actually run on
Windows. The existing test_read_archive_rejects_absolute_paths failed on
windows-latest because it constructed the archive with a POSIX-style
path that the platform-specific `is_absolute()` did not catch.

Assisted-by: Claude Code:claude-opus-4-7

Author: mikolalysenko

crates/socket-patch-core/src/patch/package.rs

@@ -94,7 +94,18 @@ pub fn read_archive_to_map(archive_path: &Path) -> Result<HashMap<String, Vec<u8
         let path_str = path.to_string_lossy().to_string();
 
         // Reject absolute paths or any `..` components.
+        //
+        // `Path::is_absolute()` is platform-aware: on Windows it requires
+        // a drive letter or UNC prefix, so a tar entry like `/etc/passwd`
+        // is NOT considered absolute and would slip through. Explicitly
+        // check the leading byte for `/` and `\` so the guard rejects
+        // POSIX-style absolute paths on every platform.
+        let leading_separator = path_str
+            .as_bytes()
+            .first()
+            .is_some_and(|b| *b == b'/' || *b == b'\\');
         if path.is_absolute()
+            || leading_separator
             || path
                 .components()
                 .any(|c| matches!(c, std::path::Component::ParentDir))
@@ -274,6 +285,18 @@ mod tests {
         assert!(matches!(err, ArchiveError::UnsafePath(_)));
     }
 
+    #[test]
+    fn test_read_archive_rejects_backslash_absolute_paths() {
+        // Tar entries with a leading backslash must also be rejected so
+        // the guard behaves consistently across POSIX and Windows.
+        let dir = tempfile::tempdir().unwrap();
+        let archive = dir.path().join("arc.tar.gz");
+        write_raw_archive(&archive, b"\\Windows\\System32\\evil.dll", b"evil");
+
+        let err = read_archive_to_map(&archive).unwrap_err();
+        assert!(matches!(err, ArchiveError::UnsafePath(_)));
+    }
+
     #[test]
     fn test_read_archive_rejects_parent_traversal() {
         let dir = tempfile::tempdir().unwrap();