[dgageot]

Summary

Replace the 4,097-entry file-count overflow fixture with two small, real tar/gzip extraction cases: three files accepted and a fourth rejected.

• Keep production extraction at the unchanged 4,096-file limit through the existing wrapper.
• Pass the file-count limit by value to an internal helper; no mutable global or public configuration.
• Verify directories and unselected files do not consume the limit, preserve extracted content, and confirm the overflow file is never written.
• Leave byte-size, expansion, unsafe-path, and snapshot tests unchanged.

Implements the archive-test finding from #4664; separate from #4669.

Hosted measurements

CI run passed, including Windows, Linux, lint, cross-compilation, gate, and CodeQL.

TestGitHubArchiveLimits/file_count now takes 0.01s on Windows and 0.01s on Linux. Earlier normal Windows CI measurements were around 42s for the 4,096 real file writes/deletions. These are test timings, not a claim about equivalent whole-job savings.

Validation

• task build
• task test
• task lint
• go test -count=1 -json ./pkg/skills -run '^TestGitHub'
• go test -race -count=1 ./pkg/skills
• Reviewer checked unchanged production behavior and boundary coverage

Cryptographically signed and DCO-signed commit.