dSYM ZIP64 and EOCD validation

Trap: checking only classic ZIP metadata or accepting the first signature-like EOCD record looks sufficient because ordinary fixtures are simple, but ZIP64 archives and signatures inside comments can bypass validation or make fflate miss entries. Fix: validate classic/ZIP64 central-directory bounds, safe integers, paths, and Unix symlink bits before extraction; select the EOCD whose declared comment ends exactly at the archive boundary, then strip only the validated comment before unzipSync().