Default source file limit rejects current WooCommerce package

## Problem

WP Codebox rejects the current official WooCommerce 11.0.0 package before Playground boot because its extracted `5,872` files exceed `DEFAULT_MAX_EXTRACTED_FILES = 5,000`. Canonical SSI fixture `20-switchback-woocommerce-extra-hard` correctly resolves the immutable WordPress.org package and passes staged-artifact dependency discovery with PR #2241, but both its initial and isolated runtime attempts fail admission with `Recipe source extraction contains too many files: 5872`.

The immutable fixture and official package must remain unchanged. The generic extraction boundary needs a bounded policy that admits current legitimate provider packages while retaining zip-bomb and resource protections.

## Evidence

- Source: `https://downloads.wordpress.org/plugin/woocommerce.11.0.0.zip`
- SHA-256: `ba08c7fc58c98a11f22866269c5832d85c52b664806ec206036f09737ba21666`
- Extracted count: `5,872`
- Current default: `5,000`
- Failure occurs before Playground/import/editor/visual execution.

## Acceptance

- Current official WooCommerce packages are admitted under a still-bounded extraction policy.
- Archive file-count, expanded-byte, per-file, path, and compression-ratio protections remain fail closed.
- Limits are explicit in source provenance/diagnostics and can be configured by trusted recipe-source class rather than silently unbounded.
- Tests cover a valid package above 5,000 files and an over-limit archive rejection.
- Canonical fixture 20 reaches import without fixture or package changes.

## AI assistance

OpenAI gpt-5.6-sol via OpenCode and a general OpenCode subagent ran the immutable fixture with the WP Codebox #2241 candidate, isolated the pre-runtime file-count admission boundary, and drafted the generic bounded policy contract. Chris Huber directed the investigation and remains responsible for the issue and resulting change.

Start at the generic extraction admission boundary around DEFAULT_MAX_EXTRACTED_FILES and inspect the existing archive safeguards. Use the canonical SSI fixture 20-switchback-woocommerce-extra-hard and the WooCommerce 11.0.0 package as reproduction inputs. Done means bounded trusted-source limits admit the valid package, over-limit archives remain rejected, protections stay fail closed, and tests cover both cases.

Written by the indexing model from the issue text.