add operational completeness hardening plugins

Author: marcofortina

docs/plugins/archive.md

@@ -99,3 +99,10 @@ Extracts a zip archive on the remote target.
 
 
 Archive plugins do not add `sudo` themselves. Run them as a user with the required remote permissions, or wrap exceptional privileged archive operations with an explicit `remote.command` until privileged archive support is added.
+
+## Safe extraction
+
+`archive.untar` and `archive.unzip` support checksum verification and safe
+extraction checks that reject absolute paths or `..` traversal before extracting.
+They also support include/exclude filtering and post-extract owner/group/mode
+handling.

docs/plugins/filesystem.md

@@ -328,3 +328,9 @@ Use `backup_before` when the target must be copied before removal. Use
 `trash_dir` when operators need a reversible move instead of an immediate
 `rm`. `allowlist` and `denylist` keep cleanup jobs scoped to known-safe path
 prefixes.
+
+## File mutation validation
+
+`fs.write`, `fs.template`, `fs.line` and `fs.replace` support validation commands
+and backup-before semantics for configuration file edits. `fs.replace` also
+supports `match_count_assert` to prevent zero-match or broad-match regex changes.

docs/plugins/firewall.md

@@ -48,3 +48,19 @@ and after runtime rule changes.
 insertion, comments, `-w` wait handling, pre-change backups and `save_after`.
 `nftables.apply` supports check-only validation, pre-apply backup, persistent
 ruleset installation and service reload.
+
+## Backend-specific firewall extras
+
+firewalld backend extras manage source bindings, ICMP blocks, masquerading and
+forward-port rules through explicit plugins: `firewalld.source`,
+`firewalld.icmp_block`, `firewalld.masquerade` and `firewalld.forward_port`.
+
+nftables extras provide readback assertion and rollback: `nftables.ruleset_assert`
+and `nftables.rollback_file`. Rollback requires `confirm: true`.
+
+iptables extras provide deletion, rule existence assertion and counter assertion:
+`iptables.delete`, `iptables.exists_assert` and `iptables.counter_assert`.
+Deletion requires `confirm: true`.
+
+UFW extras provide `ufw.delete` and `ufw.reset`. Both require `confirm: true`
+because they remove firewall state.