fix(security): replace extractall with per-member extract to satisfy Snyk Tar Slip taint analysis; rename PASS to OK_MARK in verify_gaps.py

backend/app/services/caldera_import_service.py

@@ -110,7 +110,7 @@ def _extract_zip(zip_bytes: bytes, dest: str) -> Path:
                 raise ValueError(
                     f"Zip Slip detected — '{member.filename}' resolves outside target directory"
                 )
-        zf.extractall(dest)
+            zf.extract(member, dest)
     # Assign abilities_dir = Path(dest) / _ZIP_ROOT_PREFIX / "data" / "abilities"
     abilities_dir = Path(dest) / _ZIP_ROOT_PREFIX / "data" / "abilities"
     # Check: not abilities_dir.is_dir()