Consolidate the remaining archive path-containment helpers

`#17` introduced `resolveArchivePath` in `lib/components/path.dart` and routed three archive readers through it. Two older implementations of the same invariant remain:

- `lib/services/assembler/build_service.dart:172` — `_safePath(Directory root, String name)`
- `lib/modules/dartufbt/lib/sdk/sdk_deployer.dart:149` — `_safeEntryPath(Directory targetDir, String name)` (byte-for-byte identical to the above)

Both guard the same trust class: `app_build_router.dart:70` feeds `buildFromBundle` a bundle fetched over HTTP.

`resolveArchivePath` is a behavioural superset — same split, same `..` refusal, same empty-drop, plus per-segment `sanitizePathSegment` and an injectable separator. Two differences to decide on deliberately, since this is not a pure refactor:

- `_safePath` rejects any entry containing a `.` segment (so `code/./main.c` is silently dropped rather than written); `resolveArchivePath` drops the segment and keeps the file. Dropping is the better rule.
- `_safePath` compares `part == '..'` **without trimming**, so `".. "` passes its check.

**On that second point the review evidence conflicted, so it needs settling rather than assuming.** One agent argued Win32 strips trailing spaces during normalization, canonicalizing `".. "` back to `..` and making it a live bypass. Another actually ran it on Windows 10 and found Dart's `File` creates a *literal* directory named `".. "` inside the root, with nothing escaping. The empirical result says not exploitable — but it is worth a comment recording that, so the next reader does not repeat the experiment.

`sdk_deployer.dart` lives in the `dartufbt` submodule and cannot import `lib/components/path.dart` (the dependency runs the other way). Options: move the helper into `dartufbt` and re-export it, or leave it and document the fork. Keeping all three silently is the expensive option.

- [ ] Settle the trailing-space question and record the answer
- [ ] Replace `_safePath` with `resolveArchivePath` in `build_service.dart`
- [ ] Decide what to do about the `dartufbt` copy