security: add pre-publication artifact content and startup-hook checks #486

Goal

Detect package-content injection before any artifact can reach a PyPI publication job.

Current evidence

The artifact validator rejects unexpected top-level wheel members, which should reject the exact root-level cook.pth/ sitecustomize.py payload shape. It does not yet make startup-hook rejection explicit or compare all packaged bytes with the reviewed source manifest.

Scope

• Reject .pth, sitecustomize.py, and usercustomize.py anywhere they could become startup hooks.
• Reject duplicate archive members, traversal paths, unexpected executables/native libraries, and unreviewed package data.
• Compare package file names and hashes against a canonical git archive manifest, with narrowly documented generated-file exceptions.
• Add malicious fixture archives for cook.pth, sitecustomize.py, an unexpected package, and modified legitimate module content.
• Keep the check static and pre-install; do not rely on importing the artifact to discover startup code.

Acceptance criteria

• Every fixture fails closed before the publish job.
• A legitimate release wheel and sdist continue to pass.
• The validator's output identifies the offending archive member and does not execute it.
• The package workflow makes this validation a required gate for both TestPyPI and PyPI.

This is a v1.0 supply-chain security gate.