fix: Mitigate render-drift for archive-overlays

[Tonisal-byte]

We need a way to track the resulting hash from the sum of archive overlays applied to a source. This is a blocking issue for adding archive-overlays to upstream; otherwise the render checks fail from having a stale sources file pre-archive-overlay.

Example of new origin-stub:

[[components.apache-commons-compress.source-files]]
filename = "commons-compress-1.27.1-src.tar.gz"
hash = "c7a2cef26959e687ad19b96b5ba8393d7514095e13bf0f29bd41e6b3c3cb2260d8ff23283ff3d5fd137b2522b843e7f0f50ab46bcf0f66df5383674f35f223ab"
hash-type = "SHA512"
origin = { type = "overlay"}
replace-upstream = true
replace-reason = "Upstream source tarball contains test fixtures flagged as malware by the AZL RPM signing pipeline. These files are not needed at runtime and are removed to allow SRPM publication."

[Copilot]

Pull request overview

This PR introduces first-class support for archive-scoped overlays (overlays that mutate files inside a source tarball) and adds a mechanism to stabilize render --check-only by allowing configs to record the post-overlay archive hash via a new origin.type = "overlay" source-files entry.

Changes:

• Add archive overlay processing (extract → apply overlays → deterministic repack) and refresh affected sources entries by rehashing repacked archives.
• Add origin.type = "overlay" to source-files to record expected post-overlay hashes and avoid render drift when sources aren’t downloaded.
• Harden archive extraction: sniff real compression from magic bytes, ignore PAX headers, and optionally fail on unsupported tar entry types to prevent silent data loss on repack.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
schemas/azldev.schema.json	Extends schema enum to allow "overlay" as an origin type.
internal/utils/archive/archive.go	Adds compression sniffing, extraction options, and convenience helpers for archive detection/extraction.
internal/utils/archive/archive_test.go	Adds coverage for magic-byte sniffing, mislabeled compression, and unsupported tar entry handling.
internal/providers/sourceproviders/sourcemanager.go	Skips downloading origin.type=overlay entries and guards against accidental download attempts.
internal/projectconfig/overlay.go	Adds archive-scoped overlay path detection/validation and separates “archive” vs “loose file” overlay behavior.
internal/projectconfig/overlay_test.go	Tests archive-scoped path validation and Modifies* classification.
internal/projectconfig/fingerprint_test.go	Improves fingerprint tag validation by parsing name,options and constraining allowed options.
internal/projectconfig/configfile.go	Validates overlay-origin source-files invariants (hash/hash-type required, replace-upstream enforced, uri forbidden).
internal/projectconfig/component.go	Introduces OriginTypeOverlay and updates jsonschema tags accordingly.
internal/fingerprint/fingerprint_test.go	Adds regression test ensuring archive scoping impacts component fingerprinting.
internal/app/azldev/core/sources/sourceprep.go	Adds archive overlay application phase and rehashes sources entries for repacked archives; validates overlay hash expectations.
internal/app/azldev/core/sources/sourceprep_test.go	Adds end-to-end tests for repack+rehash behavior and missing sources-entry erroring.
internal/app/azldev/core/sources/overlays.go	Updates overlay application to use the new “loose files” predicate.
internal/app/azldev/core/sources/archiveoverlays.go	Implements archive overlay grouping, extraction-root resolution, and atomic repack preserving real compression.
internal/app/azldev/core/sources/archiveoverlays_test.go	Adds exported-path integration tests for archive overlay semantics (glob removal, search/replace, skip-sources behavior).
internal/app/azldev/core/sources/archiveoverlays_internal_test.go	Adds internal unit/regression tests for grouping, extract-root resolution, strict extraction, and repack correctness.
internal/app/azldev/cmds/component/preparesources.go	Refactors conditional preparer option wiring into a helper.
docs/user/reference/config/overlays.md	Documents archive overlays (path scoping, extraction root, supported entry types, batching).
docs/user/reference/config/components.md	Documents origin.type="overlay" and recommended workflow for recording post-overlay hashes.