Fix analysis-zip corruption on shared-FS (k8s/NFS) deployments (#857)

[brianlball]

Summary

Fixes the analysis-zip corruption behind #857 at its actual sources. Cluster diagnostics (mount options, cross-pod flock test, pod logs) showed flock exclusion works on the k8s/NFS deployment — the corruption chain was:

1. lock_abandoned? probed LOCK_EX on a read-only fd — legal on local filesystems, Errno::EBADF on NFSv4 (flock is emulated as a write byte-range lock). Every waiter crashed; the deployed EBADF→abandoned runtime override then deleted live locks, letting a second worker re-create the lock on a new inode and initialize the same analysis_dir concurrently.
2. extract_archive (worker + Analysis) used the Zip::File.open block form with ::Zip.sort_entries = true: the implicit close calls commit, rewriting the archive in place for any unsorted zip — web-background rewrote the live seed zip at analysis start while workers downloaded it; workers rewrote the shared analysis.zip after every extract.
3. Downloads wrote straight to the shared path unvalidated, so truncated bytes were extracted and escalated to terminal CorruptAnalysisZip failures.
4. Workers that raced past the outer receipt check re-downloaded/re-extracted even when the receipt appeared before they got the lock (observed: 6 downloads of one analysis zip in 3s).

Changes

• lock_abandoned?: probe with LOCK_SH (grantable on read-only fds everywhere, still blocked by a live LOCK_EX); indeterminate probe = held, never abandoned.
• extract_archive (both copies): read-only Zip::File.new, no global sort_entries — archive is byte-identical after extraction.
• analysis.zip download: pid-suffixed temp file → Analysis.seed_zip_error validation → atomic rename. Transient corruption retries; 3 consecutive validation failures escalate to the existing terminal CorruptAnalysisZip cleanup (Enhance InitializeAnalysis resilience for corrupt seed.zip files #841 fail-fast preserved).
• Receipt re-check while holding the lock (kills the re-download herd).

Tests

All regression specs written red-first against the unfixed code (md5-identical archive after extract, EBADF probe crash, truncated-transfer retry, receipt re-check skip); existing #841 corrupt-zip spec updated to the new validation seam. 36 examples green across the three spec files.

Deploy notes

• CI on this branch pushes nrel/openstudio-server:179-flock images for cluster testing (temporary mapping, remove on merge).
• The helm worker.runtimeOverrides EBADF patch and the lock-janitor should be disabled when this deploys — fix 1 makes them unnecessary, and the EBADF→abandoned override is itself the live-lock deleter.

🤖 Generated with Claude Code

[brianlball]

Added ee89e42: nginx keepalive_timeout 0 → 65, gzip off → on in the baked image config (refs #864; matches the openstudio-server-helm c3c91ea ConfigMap override so that fork can be dropped once images rebuild). develop twin of this PR incl. the nginx fix: #865.

[brianlball]

Added b1caeb0: honor overwrite param in both extract_archive copies (refs #858). Red-first: new specs fail on the old skip-always behavior, green after (zf.extract(f, f_path) { true }; overwrite=false skip path pinned too). 29/29 locally across the hardening + analysis_init spec files. Same commit cherry-picked to #865 (which now carries "Closes #858").