Inspect decoded report archives instead of their base64 text

Known embedded archives need the same inspection boundary as standalone archives. Scanning base64-compressed data as literal text can both invent credential-shaped matches and miss sensitive decoded contents. Validate the packaging, decode under existing archive limits, scan surrounding text separately, and propagate nested redactions back into the emitted container. Avoid exempting entire generated reports. This method applies to known packaging formats; it is not a claim that every arbitrary encoding is safely handled.

Evidence/example — 2026-09-14: A local synthetic Playwright 1.59.1 HTML report demonstrated both directions: harmless lowercase-only JSON produced a credential-shaped base64 sequence, while an encoded synthetic authorization value passed the old literal-only scan. Reusing bounded ZIP inspection accepted the harmless case and rejected the decoded sensitive case. Tests also covered traversal, malformed encoding, duplicate templates, and redaction/reinspection. A real generated report passed the repaired policy. The original remote rejected report was unavailable, so its exact matched bytes remain unconfirmed. No private payloads or credentials are included here.