[andrew]

Git-generated tarballs include a global PAX header named pax_global_header. Both readers expose it as an empty regular file with mode 000. This prevents common-root detection, breaks normalized file paths and archive comparisons, and causes permission errors when consumers scan extracted files.

Skip tar.TypeXGlobalHeader in buffered and streaming TAR readers. Regression coverage checks root detection, extraction, stream entry limits, and preservation of real files named pax_global_header across compressed TAR, gem, and conda archives.

[Copilot]

🟢 Approval recommended

There are no active review issues for the changes that prevent global PAX metadata from being treated as TAR files.

No open issues 🎉

What changed in this PR

This PR prevents global PAX metadata from appearing as files in TAR archives, restoring common-root detection, normalized paths, and extraction behavior.

Changes:

• Skip global PAX headers in buffered and streaming TAR readers.
• Add regression coverage for compressed TAR, gem, and conda archives, including stream entry limits and real files named pax_global_header.
• Verify browser root detection and filesystem extraction.

File	Description
tar.go	Skip global PAX headers before counting or collecting archive entries.
tar_pax_test.go	Test metadata filtering, real-file preservation, entry limits, and root detection.
stream_tar.go	Skip global PAX headers when advancing the stream.
extract_test.go	Verify extraction omits metadata while preserving real files.

_{Review effort: Balanced}