fix[tool]: reject ambiguous archive members

[DicksonWu654]

What I did

Validate the complete .vyz member namespace before reading compilation targets or other manifest data. Archive reads now use one canonical, validated member index.

This prevents duplicate ZIP entries and normalized aliases such as source.vy and ./source.vy from giving different archive consumers inconsistent views, while preserving member forms emitted by Vyper on POSIX and Windows.

How I did it

• build and validate a canonical member index when constructing ZipInputBundle
• reject exact duplicates, canonical collisions, NUL names, and unaddressable path forms
• route manifest, source, and storage-layout reads through the validated index
• validate before any archive member content is read
• cover raw ZIP and base64 archive entry points

Tests

118 passed across the new namespace regressions and existing archive/compiler CLI tests.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T23:19:56.181661Z	59e3066	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.