fix(cube): harden runtime dependency graph

[acmeguy]

Intent

Make the Cube 1.7.30 release artifact deployable without dropping a supported driver or retaining known high-severity runtime dependency findings.

• force every installed Apache Thrift client to 0.23.0 while preserving Hive support
• replace the install-time-only archive extractor with a fail-closed runtime shim
• pin patched compatible branches for the affected transitive dependencies
• verify hardening during postinstall and cover Hive construction/teardown in tests
• keep both Yarn and npm lockfiles reproducible

Validation

• final linux/amd64 image built with the frozen Yarn lockfile
• exact image test suite: 711 passed, 0 failed
• exact image production audit: 0 high, 0 critical
• npm package-lock production audit: 0 high, 0 critical
• disposable npm ci --omit=dev ran both postinstall checks successfully
• Hive driver constructed and released without a network connection

Related: fraios spec 102