fix(security): harden archive extraction (#16203)

* fix(browser): confine upload paths for file chooser

* fix(browser): sanitize suggested download filenames

* chore(lint): avoid control regex in download sanitizer

* test(browser): cover absolute escape paths

* docs(browser): update upload example path

* refactor(browser): centralize upload path confinement

* fix(infra): harden tmp dir selection

* fix(security): harden archive extraction

* fix(infra): harden tar extraction filter

src/cli/browser-cli-examples.ts

@@ -24,7 +24,7 @@ export const browserActionExamples = [
   "openclaw browser hover 44",
   "openclaw browser drag 10 11",
   "openclaw browser select 9 OptionA OptionB",
-  "openclaw browser upload /tmp/file.pdf",
+  "openclaw browser upload /tmp/openclaw/uploads/file.pdf",
   'openclaw browser fill --fields \'[{"ref":"1","value":"Ada"}]\'',
   "openclaw browser dialog --accept",
   'openclaw browser wait --text "Done"',