Default source file limit rejects current WooCommerce package

## Problem

WP Codebox rejects the current official WooCommerce 11.0.0 package before Playground boot because its extracted `5,872` files exceed `DEFAULT_MAX_EXTRACTED_FILES = 5,000`. Canonical SSI fixture `20-switchback-woocommerce-extra-hard` correctly resolves the immutable WordPress.org package and passes staged-artifact dependency discovery with PR #2241, but both its initial and isolated runtime attempts fail admission with `Recipe source extraction contains too many files: 5872`.

The immutable fixture and official package must remain unchanged. The generic extraction boundary needs a bounded policy that admits current legitimate provider packages while retaining zip-bomb and resource protections.

## Evidence

- Source: `https://downloads.wordpress.org/plugin/woocommerce.11.0.0.zip`
- SHA-256: `ba08c7fc58c98a11f22866269c5832d85c52b664806ec206036f09737ba21666`
- Extracted count: `5,872`
- Current default: `5,000`
- Failure occurs before Playground/import/editor/visual execution.

## Acceptance

- Current official WooCommerce packages are admitted under a still-bounded extraction policy.
- Archive file-count, expanded-byte, per-file, path, and compression-ratio protections remain fail closed.
- Limits are explicit in source provenance/diagnostics and can be configured by trusted recipe-source class rather than silently unbounded.
- Tests cover a valid package above 5,000 files and an over-limit archive rejection.
- Canonical fixture 20 reaches import without fixture or package changes.

## AI assistance

OpenAI gpt-5.6-sol via OpenCode and a general OpenCode subagent ran the immutable fixture with the WP Codebox #2241 candidate, isolated the pre-runtime file-count admission boundary, and drafted the generic bounded policy contract. Chris Huber directed the investigation and remains responsible for the issue and resulting change.

Inizia dal limite generico di ammissione delle estrazioni intorno a DEFAULT_MAX_EXTRACTED_FILES ed esamina le protezioni esistenti per gli archivi. Usa il fixture SSI canonico 20-switchback-woocommerce-extra-hard e il pacchetto WooCommerce 11.0.0 come input di riproduzione. Il lavoro è completo quando limiti bounded per trusted-source consentono l’ammissione del pacchetto valido, gli archivi oltre il limite continuano a essere rifiutati, le protezioni restano fail closed e i test coprono entrambi i casi.

Scritto dal modello di indicizzazione a partire dal testo della issue.