[caokai674]

Summary

This consolidates #5 and #6 into one maintained branch and preserves the current main TUI extraction guards.

Fixes included

• transactional single-stream extraction: existing files survive failed decodes
• ordered 7z / 7zz / 7za backend fallback and per-archive caching
• runtime probing of actual archive creation support
• signature-only / renamed tar.xz keeps TAR+XZ member extraction
• password failure hint appears only when a password was supplied
• portable test scratch directories
• current-main preview path / symlink escape guards retained

Regression coverage

• failed stream extraction preserves an existing destination
• runtime SWFc creation capability is probed
• named standalone .xz stays on the generic stream backend
• renamed / extensionless tar.xz is detected as TAR+XZ and extracts members
• TUI preview path traversal guard stays covered

Supersedes #5 and #6 after CI passes.