[Advancement] Implement cache poisoning protections for downloaded artifacts

[Nanle-code]

Objective

Protect local caches of templates/plugins/WASM from poisoning via path checks, permissions, and integrity revalidation.

Target area

cache directories across template/plugin/wasm

Context

Local caches are an underrated supply-chain vector.

Requirements

• Enforce restrictive permissions on cache dirs
• Revalidate checksums before use
• Reject unexpected hardlinks/symlinks where unsafe

Acceptance criteria

• Poisoned/tampered cache fixtures are rejected
• Permission expectations tested on Unix
• Security docs updated

Pull request merge requirements

Pull requests that resolve this issue must not be merged until all of the following are true:

1. All required CI checks are green on the latest commit of the PR (build, tests, lint/format, and any workflow jobs required by branch protection).
2. The branch has no merge conflicts with the target branch (master / default), and a clean merge or rebase is possible without unresolved conflicts.
3. Review feedback is addressed, and the change remains focused on this issue’s acceptance criteria.

Contributors should run the local CI-equivalent checks before opening or updating the PR (see CI_ENFORCEMENT.md and CONTRIBUTING.md).

[Plutoboi00]

@Plutoboi00 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, I’ve reviewed the issue and it aligns well with my skill set. I’m confident I can resolve it properly and would be happy to take it on. Please assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Plutoboi00 to this issue.

[OpensrcLord]

@OpensrcLord has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello @maintainer, I'd love to work on this issue. I'll keep the implementation simple, clean, and well-tested.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OpensrcLord to this issue.

[tunmisedasa]

@tunmisedasa has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hey Maintainer,

I can help resolve this issue. Can you assign me?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @tunmisedasa to this issue.

[drips-wave]

Congratulations, @OpensrcLord! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @OpensrcLord: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[OpensrcLord]

@OpensrcLord Implemented and opened OpensrcLord#2. The change enforces private cache directories and rejects unsafe symlinks/non-directory cache targets while preserving archive checksum validation.

[OpensrcLord]

@OpensrcLord Correction: the implementation is now submitted to the upstream repository at #869, using the fork branch only as the PR head. This is the canonical PR for review and issue closure.