Unpack only the .lift member for streaming zip reads

[imnasnainaec]

stats and export stream entries and resolve neither companion ranges nor media, but reading a zipped package extracted the whole archive first — writing a media-heavy package's audio and WritingSystems/ to a temp directory that nothing then read. On a real audio-carrying project that is gigabytes of pure overhead per invocation.

lift_source() now narrows the write to the single .lift member. load(), validate, and check-media still unpack the full folder, which they need to resolve companions and check media presence.

User story

A Combine or FieldWorks project backup is a .zip whose shape is lopsided: single-digit MB of .lift XML beside gigabytes of audio and images. A project manager receiving those backups runs sil-lift stats backup.zip --format json on each one — in CI, or in a triage script over a folder of them — to track entry and sense counts and catch a truncated export before it is imported. Counting reads only the XML.

Before this change, every invocation wrote the whole package to a temp directory, read a few MB of it, and discarded the rest. On a CI runner with bounded temp disk, a handful of those in sequence is a real failure mode. Now stats writes one file. export has the same shape — pulling a TSV of glosses out of a package to hand to a reviewer reads the XML and nothing else.

Guards

• Entry-count cap and path-traversal rejection: unchanged, and still evaluated over the whole listing however much of it gets written — so a hostile archive is refused identically on both paths.
• Per-file streaming cap: unchanged on both paths.
• Aggregate uncompressed-size cap: full extraction only. It guards bytes written to disk, and a streaming read writes one member — so stats on a package whose media dwarfs the limit now succeeds where load() still refuses it. Deliberate, and covered by a test.

Member selection

Locating the .lift moves from globbing the extracted tree to matching archive member names, so both paths share one rule instead of the change growing a second near-duplicate; _find_lift_root() is gone.

That makes the suffix match case-insensitive on every platform. Previously it inherited Path.rglob's platform behavior, so a .LIFT member resolved on Windows but not on Linux or macOS.

Verification

python scripts/check.py green (382 passed, 94% total, _zip.py at 100%), plus mkdocs build --strict for the docs edits. New tests cover the extraction narrowing directly — asserting the temp tree holds the .lift and nothing else — along with the traversal and per-file cap paths in streaming mode and the deliberate aggregate-cap divergence.

Draft: opening for review of the guard trade-off above before marking ready.

🤖 Generated with Claude Code

---

Devin review: https://app.devin.ai/review/sillsdev/python-sil-lift/pull/17

---

This change is 

[jasonleenaylor]

Consider the api surface and user documentation detail level with regards to security hardening (probably less is more)

@jasonleenaylor reviewed 5 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on imnasnainaec).

[imnasnainaec]

User doc details adjusted/reduced.

User story added to pr body to justify api surface.

@imnasnainaec reviewed all commit messages and made 1 comment.
Reviewable status: 2 of 5 files reviewed, all discussions resolved (waiting on jasonleenaylor).