fix: speed up runpack verify zip checks

[RyshMan]

Problem

• release preflight was blocked by make bench-check
• BenchmarkVerifyZipTypical regressed beyond the allowed release threshold

Root cause

• VerifyZip paid repeated filesystem zip access costs for small runpacks
• file hashing also allocated a fresh copy buffer on each verification pass

Fix

• add a small-runpack in-memory zip fast path for verification
• reuse a pooled copy buffer during zip entry hashing
• scope the small-file fast path through os.Root APIs so the optimization remains fail-closed under security linting

Validation

• go test ./core/runpack
• go test ./core/runpack -run '^$' -bench '^BenchmarkVerifyZipTypical$' -benchmem -count=5
• make prepush-full

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e34c5e83f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".