New gadget/gadget_archive_loader.js exposes extractArchive(input): sniffs
magic bytes (PK -> JSZip, 1F 8B -> pako.ungzip + tar, ustar@257 -> tar) and
returns a JSZip-shaped iterator so loadZipIntoCrib works unchanged. The
hand-written tar parser handles GNU 'L' and PAX long names, skips links.
Ships pako 2.1.0 inflate-only build (lib/pako_inflate.min.js).

Converted all JSZip.loadAsync call sites in the import page (URL, file,
torrent, base64 data) and landing gadget (file drop, URL, torrent — also
covers the crib_loader updater via the jio_cribjs scope). Widened file
accept attributes and labels; app-name slug now strips tar extensions.

5 new QUnit tests (zip, tgz, tar, GNU long filename, unknown format);
suite at 48 tests / 113 assertions, all green. Verified e2e headless:
URL-import of a 166 KB spa-latest.tar.gz with app_name set in the hash
installs and serves on a fresh staging subdomain.

Also: CLAUDE.md documents the RSVP.Queue promise-chain convention, and
the project skills (.claude/skills/) are now checked in.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>