feat(#176): read PHP's native phar containers

[helly25]

libarchive does not read the native phar format at all, so the archive extra gains its own reader behind the same Member shape the libarchive reader presents. A phar is a PHP script (the "stub") ending in __HALT_COMPILER();, followed by a binary manifest and then the member data - a layout no generic archive library recognises. The tar- and zip-based phar variants (.phar.tar, .phar.zip) need none of this: they are ordinary tars and zips that the libarchive reader already handles.

Entry points mirror the libarchive reader, in-memory and file-based: ListPharMembers, ListPharMembersOfFile, ReadPharMember, ReadPharMemberOfFile.

Details worth stating, each test-pinned:

• Neither entry point reads a whole container. Listing reads the stub scan window plus exactly the manifest length the header declares; a content read then seeks to that one member's byte range. The stub scan is bounded (1 MiB) so handing the walk a large non-phar file cannot turn into a full read, and the declared manifest length is capped so a corrupt or hostile length field cannot become a huge allocation.
• Every declared length is honoured even when the value is unused (the API version, the container alias, the per-member metadata). Skipping one does not fail - it shifts every following field, which is why a non-empty alias and a second member's data offset each have their own case.
• A directory member is the trailing-slash spelling of a name; phar has no flag bit for it. The reported path drops the slash, and a read of it reports FailedPrecondition ("no content"), not NotFound.
• A per-member compressed entry is refused with Unimplemented rather than returning the stored bytes (phar may deflate or bzip2 individual members). Returning them would make -grep silently miss a pattern the member does contain. Decompression is a follow-up slice; listing such members already works, since the manifest carries their metadata regardless.
• Errors keep the libarchive reader's split: InvalidArgument for "not a phar" (the walk treats it as an ordinary file) versus DataLoss for a phar-shaped container whose manifest is truncated, lies about its member count, or points member data past the end.

Member-name normalization (./x and dir/ spellings) moves into xff_extras_api's member-path library as NormalizeMemberName, since both readers need exactly the same rule and that library owns member-path spelling. #457 added the same rule locally in archive_reader.cc; once #457 is in, that copy is replaced by this shared one (this branch does the swap when it syncs, so no duplication lands on main).

There is no phar writer to lean on, so the test builds containers byte by byte: the fixture is the format specification.

Not wired to --archive yet - that is the engine-mount slice, and AUTO-separator / per-format scheme questions (#177) stay open and untouched here.

Side note for a later slice: compile_commands-update.sh uses the extractor's refresh_all, which covers //... only, so no extras source is in the compile DB and clang-tidy cannot see this directory (it reports 'xff/archive/*.h' file not found for the existing reader too). Worth fixing separately.

Part of #176. Not armed for auto-merge; queued behind #455 / #456 / #457.