Replace vulnerable plugin release extractor

[den-sq]

Summary

• replace @terascope/fetch-github-release and its unpatched extract-zip dependency with native GitHub asset downloads and node-stream-zip's whole-archive extraction API
• preserve the existing release selection, URL parsing, output directory, parallel asset download, overwrite, installation, and cleanup behavior
• refresh transitive js-yaml and nanoid locks to their patched releases

Closes #131

Security behavior

• No advisory is allowlisted.
• downloadPlugin remains the only public plugin-release install entry point.
• Ouroboros does not implement archive-entry handling or add archive-content policies; extraction behavior belongs to node-stream-zip.
• node-stream-zip@1.16.0 has no runtime dependencies and its extractor is not affected by the extract-zip advisory.

Validation

• npm ci (735 packages audited, 0 vulnerabilities)
• npm run audit:release (0 vulnerabilities)
• npm run test:release (both release test files pass, including the normal plugin download/extraction integration)
• npm run build
• targeted ESLint and Prettier checks
• git diff --check

The clean install still prints existing deprecation notices through unchanged build-tool dependency chains. The build also prints the existing Google Fonts DNS warning when run in the restricted sandbox; neither warning is introduced by node-stream-zip.

Shared-basis audit

• Inspected the canonical downloadPlugin lifecycle, addLocalPlugin, the release audit validator, release CI, and the exact @terascope/fetch-github-release implementation previously used by this call site.
• Reused downloadPlugin as the owning entry point and preserved its established release and temporary-directory lifecycle. The normal Node release-test seam exercises that public download/extract behavior.
• Considered unzipper, direct yauzl entry processing, and a package override. Selected node-stream-zip because it owns the complete extract-to-directory operation, ships TypeScript declarations, and has no runtime dependencies; direct yauzl processing and an override would leave Ouroboros owning extra extraction machinery.
• Load-bearing decision: keep node-stream-zip as a production dependency because Electron Vite externalizes main-process dependencies.
• Consequence: archive semantics are those of the maintained extraction package. Ouroboros adds no symlink, special-file, collision, URL-origin, or temporary-directory policy.
• Approved overlapping mechanisms: none.