docs: publish Tend Compose continuity evidence

Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/deploy/release_test.go

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package deploy
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeHostileArchive(t *testing.T, name string, typeflag byte) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "bad.tar.gz")
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gz := gzip.NewWriter(file)
+	tw := tar.NewWriter(gz)
+	body := []byte("x")
+	if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: typeflag, Mode: 0o644, Size: int64(len(body))}); err != nil {
+		t.Fatal(err)
+	}
+	if typeflag == tar.TypeReg {
+		_, _ = tw.Write(body)
+	}
+	_ = tw.Close()
+	_ = gz.Close()
+	_ = file.Close()
+	stage := filepath.Join(t.TempDir(), "stage")
+	_ = os.Mkdir(stage, 0o700)
+	if err := extractArtifact(path, stage); err == nil {
+		t.Fatalf("accepted hostile entry %q type %d", name, typeflag)
+	}
+}
+func TestExtractionRejectsTraversalAndLinks(t *testing.T) {
+	writeHostileArchive(t, "bundle/../../escape", tar.TypeReg)
+	writeHostileArchive(t, "bundle/link", tar.TypeSymlink)
+}