fix: 对账 P0-P2 一轮全消 (CSV想拦35→0, CSV想放5→0)

引擎修复:
- policy.yaml allowed_extensions 补 .java/.log/.ttf/.dwg/.odt 等 20+ 类型 (白名单 gate 被拒根因)
- structure.py SuspiciousImports weight 45→25 (单一 API 不再直接 100 分 malicious)
- structure.py 新增 EncryptedArchive 显式检测 (flag_bits bit0=1)
- rules/rule_labels.yaml 新增 EncryptedArchive → 加密压缩包

样本修复:
- L0-020/021 zip_bomb 重写: DEFLATED 50×50MB/20×20MB → 膨胀比 1027x/1023x ✅ ArchiveBombSuspect reject
- L0-030 nested_traversal 重写: 真 ../穿越 + 内层 zip → PathTraversal malicious
- L0-024 encrypted 重写: flag_bits bit0=1 → EncryptedArchive suspicious

最终 P0-P2 关键修复项 9/9 通过:
  ✅ NEG-007 java clean (白名单放行)
  ✅ NEG-011 log clean (白名单放行)
  ✅ NEG-015 ttf clean (白名单放行)
  ✅ NEG-016 dwg clean (白名单放行)
  ✅ NEG-020 odt clean (白名单放行)
  ✅ L0-020 zip_bomb reject ArchiveBombSuspect
  ✅ L0-021 small_bomb reject ArchiveBombSuspect
  ✅ L0-024 encrypted suspicious EncryptedArchive
  ✅ L0-030 nested malicious PathTraversal

app/engines/structure.py

@@ -870,6 +870,7 @@ class StructureEngine(Engine):
         executable_members: List[str] = []
         traversal_members: List[str] = []
         member_count = 0
+        encrypted_count = 0
 
         try:
             with zipfile.ZipFile(target.path) as zf:
@@ -883,6 +884,8 @@ class StructureEngine(Engine):
                         executable_members.append(name)
                     if _is_path_traversal(name):
                         traversal_members.append(name)
+                    if info.flag_bits & 0x1:  # ZIP 加密标志（bit 0）
+                        encrypted_count += 1
         except Exception as exc:  # noqa: BLE001
             return [
                 Finding(
@@ -955,6 +958,18 @@ class StructureEngine(Engine):
                 )
             )
 
+        if encrypted_count > 0:
+            findings.append(
+                Finding(
+                    engine=self.name,
+                    layer=self.layer,
+                    severity=Severity.MEDIUM.value,
+                    rule="EncryptedArchive",
+                    detail=f"归档内含加密成员 {encrypted_count} 个（bit0 flag 置位），无法扫描内部内容",
+                    weight=20.0,
+                )
+            )
+
         return findings
 
     def _inspect_tar(self, target: ScanTarget, max_ratio: int, max_total: int) -> List[Finding]: