peekHeader ZIP scan boundaries

Trap: returning PeekResult.format = "unknown" or recursively scanning nested ZIPs looks thorough because every object gets a format and scanZips suggests recursive discovery. Fix: peekHeader() returns null for unrecognized formats, and ZIP contents are scanned only one level regardless of scanZips; recursion changes the established DIF scan boundary and can amplify untrusted archive work.