archive.extract-member passes a member name to tar without --

[haribo]

What happens

archive.extract-member passes the member name to tar without --:

tar xzOf "$src" "$member"                      # observe
tar xzOf "$src" "$member" > "$staged"          # apply

A member whose name starts with a dash is read as options. Reproduced:

$ tar xzOf /t/a.tgz "-rf.txt"
tar: You may not specify more than one '-Acdtrux', '--delete' or '--test-label' option

$ tar xzOf /t/a.tgz -- "-rf.txt"
content

Scope, honestly

Low severity. The member has to be named -rf.txt without a ./ prefix, which tar czf … . does not produce — the archive has to come from elsewhere, or from --transform.
It is a one-token fix, and the surrounding defs already treat hostile arguments as ordinary
input (#535), so leaving this one inconsistent is the thing to correct rather than the risk
itself.

Build

-- before the member in both places. Check the other tar calls in the same file while
there: tar xzf "$src" -C "$dst" and tar tzf "$src" take no member, so they are not
affected — confirm rather than assume.

Validation

• An adverse case extending adverse-archive.extract-member.shellf: an archive built with
  --transform so a member is named -rf.txt, extracted by name. Red before the fix.

[haribo]

Audit against the current code

Confirmed. internal/std/archive/archive.shellf:62 (observe) and :75 (apply) both pass
"$member" to tar with no --.

The two other tar calls in the file are unaffected, checked rather than assumed:
:33 is tar xzf "$src" -C "$dst" and :40 is tar tzf "$src". Neither names a member, so
no caller-supplied value reaches tar's argument list there.

The severity assessment in the issue holds: the member must be named -rf.txt with no ./
prefix, which tar czf … . does not produce. This is a consistency fix — #535 settled that a
hostile argument is ordinary input — not a live exposure.

[haribo]

Delivered in #648, squashed on develop.

-- before the member on both archive.shellf:62 (observe) and :78 (apply). The two other
tar calls in the file take no member and were checked, not assumed.

test/e2e/plans/adverse-archive.extract-member-dash.shellf, verified red first:

RED   ! tar: You may not specify more than one '-Acdtrux', '--delete' or '--test-label' option
green out.txt holds `dashed`

Its own file rather than an extension of adverse-archive.extract-member.shellf: one plan per
case (adverse-cases.md), and that plan already carries the space/quote/& argument. The
fixture needs no --transform — tar czf … -C src -- -rf.txt stores the bare name.