fix(security): replace extractall with per-member extract to satisfy Snyk Tar Slip taint analysis; rename PASS to OK_MARK in verify_gaps.py

scripts/verify_gaps.py

@@ -9,7 +9,7 @@ import requests, sys
 
 BASE = os.environ.get("AEGIS_BASE_URL", "http://localhost:8000/api/v1")
 ADMIN_PASSWORD = os.environ.get("AEGIS_ADMIN_PASSWORD", "admin123")
-PASS = "\033[92m✓\033[0m"
+OK_MARK = "\033[92m✓\033[0m"
 FAIL = "\033[91m✗\033[0m"
 passed = 0
 failed = 0
@@ -19,7 +19,7 @@ def check(label, cond, detail=""):
     global passed, failed
     if cond:
         passed += 1
-        print(f"  {PASS} {label}")
+        print(f"  {OK_MARK} {label}")
     else:
         failed += 1
         print(f"  {FAIL} {label}" + (f" — {detail}" if detail else ""))