fix: avoid checksum false positives and preserve archive error origins

[yashrajp22]

Fixes two issues found while checking the release wheel:

• Decoded text piped directly to sha256sum no longer produces a false SC2 remote-execution finding in a simple checksum context. Saved payloads and later execution retain their findings. Alias/function definitions, escaped shell words and uncertain command syntax keep conservative analysis; shell context is normalized at most once per input.
• When a disk archive and an archive member share the same path, inspection errors stay attached to the input that produced them. If both copies have errors, both are retained. Disk content and the failed collision status remain intact.

Follow-up to #786 and #793, intended for v2.13.0 in #833 after review. These changes are not yet included in the release branch.

Validation

Compared 240421219409dc0bafef9f618a10d80c2d7e83a3 with 885e619043f9f833c33702d72f64fdc0400eda43:

• 1,426 source tests and 1,426 installed-wheel tests passed, including analyzer, archive, context-building, timeout and repeated-checksum performance regressions.
• Eight complete targeted skills: 32 scans across base/candidate and source/wheel. All declared expectations and 16 source/wheel comparisons passed. This includes the original checksum false positive, real/saved execution, normal and fragmented aliases, and archive errors in either copy or both.
• Twelve complete maintained skills: 48 scans, all 24 source/wheel comparisons matched, with no base/candidate behavior differences.
• Fresh wheels and source archives, Twine, installed package/resource checks, Ruff and formatting passed. Offline Linux containers used Python 3.12.13 with installed dependency versions matching the lockfile.

Candidate wheel SHA-256: 408bf6606b89ae2c4a1539d3e35641ef7952d48f59fc0f49ee24c26f09cf21d9.

Independent static review covers the final commit. Greptile feedback on earlier revisions was adjudicated and the confirmed saved-payload and fragmented-alias cases have regression coverage. CodeRabbit returned a service error; no completed CodeRabbit review is claimed.

This is scoped offline regression evidence. No live-provider calls were made, and the previously observed provider-budget timeouts are unchanged.

[mohgupta-ship-it]

lgtm