Detect tarballs created not from the root of the source repo

This was observed on a Fedora 43 docker image, package `cracklib`:

- https://github.com/cracklib/cracklib/tree/v2.10.3/ -- the source repo has all source code under the `src/` subdir
- https://github.com/cracklib/cracklib/releases/download/v2.10.3/cracklib-2.10.3.zip -- published tarballs move the source code from under `src/` to `./` (root dir)

Thus, file-matching logic in our tool completely fails.

Start by tracing the package file-matching logic used by the CLI and compare its assumptions with the cracklib repository and published archive described in the issue. Confirm the failure against the Fedora 43 Docker environment or equivalent fixtures; done means archives whose source moved from src/ to the root are detected and validated correctly.

Written by the indexing model from the issue text.