[log0u7]

Summary

• ingest generalizes across CTF-Archives events (Zeekr 2026-09-19, WQB 2026-09-04, CCB 2026-09-13): extraction layouts vary per zip (wrapper dirs, nesting), so challenges resolve to their content root and deduplicate by that root (symlink-cycle guarded), longest directory name = canonical challenge name.
• Statement matching strips the hex-hash suffix of release dir names: all 29 WQB/CCB statements extract now (verified on cold_forge + ticketsage).
• 30 new tier-B challenges (WQB 27 slots incl. SilentConfig tar.gz, CCB 3): statements in Chinese, flag format only, writeups never embedded. The statement-less incident log bundle stays OUT of the corpus (gitleaks trips on its fictional decoy UUID; the tar.gz remains in the local store - no allowlist needed, the file is not in this history).
• Regression guards: case-id charset/uniqueness asserts, manifest-vs-cases consistency test (the orphan class found by review), statement-less fallback test, symlink-cycle test. The three legacy pack examples are scoped out of the consistency check (hand-written, pre-corpus).
• New totals: 52 corpus cases (12 verified tier, 40 tier-B) + 3 legacy pack examples.

Issue for this PR

N/A

Checklist

• Conventional Commits
• test_ctf_ingest.py: 6 tests across the three extraction layouts
• 473 tests + lint + mypy green locally