Probe 7z listings and ZIP starts

7z keeps its file list at the end of the archive, so the 7z-tail
candidates (the last segment of the highest volume) were queued but
never probed, and the .7z.001 start only gave the type. The prober now
claims 7z-tail candidates after the archives; lib/sevenzip finds the end
header in the article, decodes the LZMA-packed header (a TypeScript port
of the LZMA SDK's reference decoder) and lists the files with their
sizes. An AES-encrypted header means passworded without names. Names
feed the inner name and the judge's fake rule.

An unsplit .7z of several segments now also gets a tail candidate, and
.zip files an archive candidate: their first segment's local headers
give the first entries and whether they are encrypted. Both in the Rust
edge and the TypeScript indexer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/services/release_judge.ts

@@ -59,7 +59,7 @@ export const RULES: Rule[] = [
     // An archive whose entries are all executables, under a media name (its own or its entries'); or a file that is
     // an executable by name or by its first bytes, under a media name.
     sql: (scoped) => `SELECT i.release_id FROM release_inspections i JOIN releases r ON r.id = i.release_id ${only(scoped, 'i.release_id')}
-          WHERE i.kind = 'archive' AND jsonb_array_length(i.result->'names') > 0
+          WHERE i.kind IN ('archive', '7z-tail') AND jsonb_array_length(i.result->'names') > 0
             AND NOT EXISTS (SELECT 1 FROM jsonb_array_elements_text(i.result->'names') n WHERE n !~* '${EXECUTABLE}')
             AND (r.name ~* '${MEDIA}' OR (i.result->>'names') ~* '${MEDIA}')
           UNION