fix(backup): tolerate timestamps outside ZIP range

[er-s-an]

Summary

Files with timestamps outside the ZIP format's 1980–2107 range can abort both manual backups and the user-data backup performed before a self-update. Epoch-zero timestamps from package-registry files reproduce the lower-bound failure. Far-future timestamps also fail, and local timezone conversion can move a UTC boundary timestamp out of range.

Use ZipFile(strict_timestamps=False) in both backup writers so ZIP entry timestamps are clamped by the standard library. The file contents, Unix permissions, and source timestamps remain unchanged. Manual-backup metadata keeps the original modification time.

Related to #1904: this addresses the timestamp failure only. Directory scanning and backup inclusion/exclusion behavior are unchanged, so the separate scan-performance report remains open.

Validation

Against ready at 60c940fd03fdaf60993b70070e6ca7142718200b, Python 3.12.14:

• New regression matrix: 30 passed across both backup writers, UTC, UTC−5, and UTC+9; covers epoch zero, both ZIP boundaries, ordinary timestamps, and a future timestamp. Checks contents, CRC, permissions, source metadata, and manual-backup metadata.
• Same tests with pristine production code: 16 failed, 14 passed.
• Focused backup/update/archive/security run: 101 passed, 2 failed. The same two tests fail on pristine ready (71 passed, 2 failed) because the execution sandbox denies Unix sockets:
  • test_self_update_manager_usr_backup_skips_runtime_sockets
  • test_self_update_manager_cleans_transient_desktop_agent_state
• Process timezone state checked before/after the regression suite and fully restored.
• Changed-source syntax, fatal-error lint, new-test Ruff check/format, and whitespace checks passed.
• Independent review completed; owning helper/runtime docs updated.

Focused command:

python -m pytest tests/test_backup_timestamps.py tests/test_backup_large_archives.py tests/test_self_update_tag_filter.py tests/test_self_update_runtime_sync.py tests/test_file_transfer_safety.py tests/test_file_browser_archives.py -q

The full repository suite and a live Docker self-update were not run. No dependency changes. AI-assisted implementation and review.