[ShookEagle]

Summary

Repository builds failed before compilation because GitHub rejects the binary release-asset Accept header on its source-archive API, and normal Git archive metadata was rejected during extraction.

 GitHub source archive request
-  Accept: application/octet-stream
+  Accept: application/vnd.github+json
 Tar extraction
-  reject global PAX metadata
+  count, validate and skip global PAX metadata

Repository lookup errors now name the repository and ref, making shared include failures identifiable. Correct the example refs for dxlevel-restrict, anti-voice-overflow and multicolors to the owner-confirmed master branch.

Evidence

• Before: The live Lilac archive request returned HTTP 415 with application/octet-stream. After correcting that header, extraction failed on its pax_global_header commit metadata. Focused regressions reproduced both failures.
  After: The same public Lilac revision downloaded and compiled with official SourceMod 1.13.0.7478 into a package containing the disabled plugin and 19 translations.
• go test -race ./..., go vet ./..., CGO_ENABLED=0 go build ./cmd/..., formatting and whitespace checks pass.
• Regression coverage includes GitHub archive redirects, binary release headers, primary/include lookup diagnostics, global metadata in primary/include archives, and sparse-global metadata rejection. Existing unsafe archive checks pass.

Merge Danger

Door: two-way

The fix can be reverted without a data migration. Servers need an updated runtime image to use it; private plugin builds still require validation on the target server.

Blast Radius: acquisition

Changes affect source archive requests and tar metadata handling. File/link restrictions, archive bounds, credential handling and package approval remain enforced.