test: add path safety, validation, and JSON deserialize regression coverage

[cursor]

Risky behavior now covered

• Path traversal on extract (path_safety.py): rejects writes outside allowed base, ../ escapes, overlong paths, and strict missing-path mode; validates PYKOTOR_EXTRACT_DIR behavior.
• CLI get output safety: cmd_get returns exit code 1 and logs rejection when output resolves outside CWD.
• Installation validation (validation.py): missing essential 2DAs, TXI/2DA lookup, module resource reference checks, and get_installation_summary counts.
• JSON archive deserialize (resource_json.py / archive_serializer.py): base64 and GFF-JSON embedded payloads, direct JSON binary wrapper, and ERF base64 round-trip via dict_to_archive.

Test files added/updated

File	Change
Libraries/PyKotor/tests/test_path_safety.py	New — 10 unit tests
Libraries/PyKotor/tests/test_validation.py	New — 7 unit tests
Libraries/PyKotor/tests/test_resource_json_deserialize.py	New — 6 unit tests
Libraries/PyKotor/tests/resource/formats/test_archive_serializer_regressions.py	ERF base64 round-trip
Libraries/PyKotor/tests/cli/test_json_commands.py	cmd_get path rejection

Production fixes uncovered by new tests

• deserialize_embedded_resource_payload: pass raw bytes instead of BytesIO to JSON readers (peek pass closed the stream).
• _dict_to_erf / _dict_to_rim: use bytearray instead of BytesIO after write_* closes the stream.

Why this reduces regression risk

These areas guard high-blast-radius flows: MCP/CLI extract path safety, installation health checks used by CLI and MCP tools, and archive JSON round-trips used by from-json / archive conversion. The new tests are deterministic, use tmp_path fixtures, and do not require a game install.

Validation

QT_QPA_PLATFORM=offscreen uv run pytest --import-mode=importlib -m "not gui and not slow" --timeout=120 \
  tests/test_path_safety.py tests/test_validation.py tests/test_resource_json_deserialize.py \
  tests/resource/formats/test_archive_serializer_regressions.py \
  tests/cli/test_json_commands.py::test_cmd_get_rejects_output_path_outside_cwd

29 passed

  

[github-actions]

Message that will be displayed on users' first pull request