fix(report): preserve archive member provenance in JSON

[mohgupta-ship-it]

JSON component rows omitted archive provenance already present in the scanner inventory. A consumer therefore received paths such as bundle.whl!/package/module.py without the structured container and member fields needed to interpret them.

Preserve outer_path, nested_path, and container metadata for archive members while keeping the existing virtual path, executable flags, source identity, findings, risk scoring, and completeness behavior. Ordinary filenames containing !/ remain ordinary files. Document how consumers should interpret the additive fields; existing consumer validators still need to adopt them.

Validation:

• 408 focused report and archive tests passed, including eight new regression cases.
• Repository lint and formatting checks passed.
• A freshly built and installed wheel preserved provenance for synthetic wheels, retained SC9 findings, and rejected an incomplete nested archive with exit 2.
• The complete Python suite was not completed locally. Local Docker smoke testing was unavailable because the container service could not be reached; both remain CI checks.

Prepared by Codex on Mohit's behalf.

[yashrajp22]

Looks good. The archive fields retain full member provenance without changing the existing component fields, findings, risk, or completeness behavior.

Verified at ec25931: 227 existing tests pass in BASE and HEAD, from source and fresh installed wheels. HEAD passes all 8 new regression tests; BASE fails exactly the 3 expected provenance cases. All 84 offline corpus and archive-fixture reports pass the scoped comparison checks.