[servicememeai]

DEV ZIP creation fails with Path-qualified authorization required: the existing ZIP RPC issues unbound native tickets even when this operation needs path authority.

This PR is limited to that ticket compatibility gap:

• Keep ordinary CE ZIP issuance unchanged, including native directory payloads without parent_dir, empty-user public-share multi-selection and SeaDoc display-name aliases.
• Only when the existing native unscoped guard requires path authority, validate and bind authenticated ZIP selections using the existing object lookup and whole-subtree permission checks. Preserve canonical nested relative selections and reject traversal, missing objects and unverifiable targets.
• Let the Go file service recognize these native path-bound ZIP tickets. Unbound tickets retain the existing guard.

Final diff: 2 implementation files and one existing Go test file (133 additions, 1 deletion). No new RPC, schema, configuration, background tasks, Hub/Etech changes or test framework. Archive streaming/error handling is outside this PR; the previously added stream-abort change and large native/archive test harnesses have been removed from the diff.

Validation for this revision:

• Existing Go file/ZIP scope tests pass.
• Local ad-hoc native token probe: 8 groups pass, including ordinary CE compatibility and authenticated nested selections. This probe is kept outside the PR.
• gofmt and git diff --check pass.

Linux integration status remains unresolved, so keep this PR Draft. On the preceding revision ea5a90e, run 40301891244 compiled C/Go and passed the first Go-fileserver test phase (103 passed, 9 skipped, 191 subtests, including the native ZIP test). Its second C-fileserver phase failed during initialization with a missing RPC socket; the separate checks job also hits the known cloudfile-docker tool-path mismatch. Neither quick CI nor the local probes prove complete Linux/DEV acceptance. No merge, deployment or environment mutation has been performed.

Minimal CI repair (c52830e)

• Correct shared gate paths to cloudfile-docker/tools/gates/.
• V2 runner selects the supported Go fileserver because native startup explicitly rejects C HTTP mode; full C compilation and the integration suite remain enabled. Upstream runner defaults remain unchanged.
• Python syntax and three backend-selection cases pass. Run 40304922992 executed the corrected cross-repository checks. That job reports six failing Hub/Docker test groups (storage fixture collection, root contracts, Hub identity/ACL tests, configuration generation); the full workflow is not green. Server build-c result is tracked separately in the run.