chore: record ZIP artifact task completion

.trellis/tasks/08-26-rc-p5b-zip-import/check.jsonl

@@ -0,0 +1 @@
+{"_example": "Fill with {\"file\": \"<path>\", \"reason\": \"<why>\"}. Put spec/research files only — no code paths. Run `python3 .trellis/scripts/get_context.py --mode packages` to list available specs. Delete this line once real entries are added."}

.trellis/tasks/08-26-rc-p5b-zip-import/design.md

@@ -0,0 +1,19 @@
+# P5B ZIP Import Design
+
+`scripts/lib/native-road-package.js` becomes the single host adapter. It resolves the config-relative
+ZIP path, hashes it, validates central-directory entry names and metadata, and extracts only accepted
+regular files to `_pipeline/native-road-import/<sha256>/`. It validates the unpacked manifest and
+returns an immutable package descriptor:
+
+```text
+{ zipFile, zipRecord, rootDir, manifest, records }
+```
+
+The descriptor replaces `area.outputs.nativeRoadDir` as native input for Blender, native preview traffic,
+diagnostics and stage manifests. The configured ZIP and unpacked cache are inputs, never published area
+outputs. Cache invalidation is by ZIP SHA-256; cleanup only deletes importer-owned hash directories.
+
+The importer rejects any non-root-flat layout, duplicate path, symlink, unsupported compression/error,
+path traversal, invalid manifest, area mismatch or declared/published mismatch before Blender starts.
+The native compiler CLI dependency and host-owned `nativeRoad` compilation options are removed. Legacy
+`osm2streets` remains an explicit separate provider.

.trellis/tasks/08-26-rc-p5b-zip-import/implement.jsonl

@@ -0,0 +1 @@
+{"_example": "Fill with {\"file\": \"<path>\", \"reason\": \"<why>\"}. Put spec/research files only — no code paths. Run `python3 .trellis/scripts/get_context.py --mode packages` to list available specs. Delete this line once real entries are added."}

.trellis/tasks/08-26-rc-p5b-zip-import/implement.md

@@ -0,0 +1,12 @@
+# P5B Execution Plan
+
+1. Add config normalization for `nativeRoadPackage`, migrate two supported configs and the template.
+2. Add the tested ZIP importer with bounded extraction, root-flat/path/symlink validation, SHA cache and
+   manifest/area validation.
+3. Route Blender, preview traffic, stage manifests and diagnostics through the imported descriptor.
+4. Delete compiler CLI/compile production paths and package dependency; replace their tests with ZIP fixture
+   and negative importer tests.
+5. Update docs/specs, run native/legacy unit suites, build two exported packages, then run Blender parity.
+
+Rollback: restore the old compiler dependency and native compile path in one revert; ZIP exports remain
+non-destructive standalone files.

.trellis/tasks/08-26-rc-p5b-zip-import/prd.md

@@ -0,0 +1,40 @@
+# ZIP 道路包安全导入与纯消费
+
+## Goal
+
+让 osmWorkflow 配置、校验、解压并消费 road-compiler Web 导出的 ZIP 道路包，移除 compiler runtime 耦合。
+
+## Requirements
+
+- 区域配置以 `nativeRoadPackage` 指向 ZIP，路径相对于该区域配置文件；native provider 不再
+  接受 compiler options、overrides 或输出目录作为输入。
+- 宿主在任何 Blender / Cesium 副作用前，验证 ZIP 文件、条目数量/大小、root-flat 文件路径、
+  无重复路径、无符号链接、无绝对路径与 `..` 路径。
+- 仅将已验证的文件解压至 `<area>/_pipeline/native-road-import/<zip-sha256>/`；解压目录是宿主
+  私有缓存，绝不写回 ZIP 或 road-compiler 导出目录。
+- 共享 importer 为 Blender、preview traffic、diagnose/check 和 stage manifest 提供同一包路径与
+  文件记录；不能让下游自行按字符串拼接另一份 native-road 目录。
+- 移除 compiler package、CLI wrapper、compile script、编译器输入配置、以及只覆盖旧调用链的测试。
+
+## Acceptance Criteria
+
+- [ ] 两个有效区域均从 ZIP 完成 `blender,cesium,package,preview`，构建日志没有 compiler CLI。
+- [ ] 缺 ZIP、错误 ZIP、nested root、path traversal、symbolic link、错误 contract、错误 areaId 和
+      manifest/source 不匹配均在启动 Blender 前失败。
+- [ ] stage manifest、`diagnose:area` 与 `check:area` 记录 ZIP hash 和已验证的导入目录；ZIP
+      修改后会被判 stale。
+- [ ] `package.json`、lockfile、生产脚本与宿主测试不再引用 `@osm-asset/road-compiler`。
+- [ ] Blender digest 对 P3 control 基线一致；legacy `osm2streets` 路径的单元测试不变。
+
+## Out of Scope
+
+- p5a 的 ZIP 生成与 Web 下载实现。
+- ZIP 远程下载、解密、签名验证或制品库管理。
+- 改道路内容、材质或 legacy QGIS 行为。
+
+## Key Decisions
+
+- ZIP 是只读输入；宿主缓存的生命周期和目录 ownership 完全属于 `_pipeline/`。
+- ZIP 解码由明确声明的 Node ZIP 库完成，而不是依赖系统 `unzip`；这使路径/符号链接校验可控并
+  可在单元测试中覆盖。
+- 只有 `native-road-package/v1.1` 可被导入；契约升级必须另开兼容任务。