Default source file limit rejects current WooCommerce package

## Problem

WP Codebox rejects the current official WooCommerce 11.0.0 package before Playground boot because its extracted `5,872` files exceed `DEFAULT_MAX_EXTRACTED_FILES = 5,000`. Canonical SSI fixture `20-switchback-woocommerce-extra-hard` correctly resolves the immutable WordPress.org package and passes staged-artifact dependency discovery with PR #2241, but both its initial and isolated runtime attempts fail admission with `Recipe source extraction contains too many files: 5872`.

The immutable fixture and official package must remain unchanged. The generic extraction boundary needs a bounded policy that admits current legitimate provider packages while retaining zip-bomb and resource protections.

## Evidence

- Source: `https://downloads.wordpress.org/plugin/woocommerce.11.0.0.zip`
- SHA-256: `ba08c7fc58c98a11f22866269c5832d85c52b664806ec206036f09737ba21666`
- Extracted count: `5,872`
- Current default: `5,000`
- Failure occurs before Playground/import/editor/visual execution.

## Acceptance

- Current official WooCommerce packages are admitted under a still-bounded extraction policy.
- Archive file-count, expanded-byte, per-file, path, and compression-ratio protections remain fail closed.
- Limits are explicit in source provenance/diagnostics and can be configured by trusted recipe-source class rather than silently unbounded.
- Tests cover a valid package above 5,000 files and an over-limit archive rejection.
- Canonical fixture 20 reaches import without fixture or package changes.

## AI assistance

OpenAI gpt-5.6-sol via OpenCode and a general OpenCode subagent ran the immutable fixture with the WP Codebox #2241 candidate, isolated the pre-runtime file-count admission boundary, and drafted the generic bounded policy contract. Chris Huber directed the investigation and remains responsible for the issue and resulting change.

Beginne an der generischen Zulassungsgrenze für Extraktionen rund um DEFAULT_MAX_EXTRACTED_FILES und prüfe die vorhandenen Schutzmaßnahmen für Archive. Verwende das kanonische SSI-Fixture 20-switchback-woocommerce-extra-hard und das WooCommerce-11.0.0-Paket als Reproduktionsinputs. Erledigt ist die Aufgabe, wenn begrenzte trusted-source-Limits das gültige Paket zulassen, Archive über dem Limit weiterhin abgewiesen werden, die Schutzmechanismen fail closed bleiben und Tests beide Fälle abdecken.

Vom Indexierungsmodell aus dem Issue-Text verfasst.