Harden curation, EC-data and archive-handling modules

[edkerk]

Tier-2 of the raven-python review: a correctness/security audit of the modules that
post-dated the prior review — curation/batch.py, io/ec_data.py, and the
download/extract pair binaries.py / data.py. Four verified, targeted fixes; no
behaviour change on well-formed inputs.

Fixes

• curation/batch.py — when building a new reaction, a list-valued subSystems
  (a reaction can belong to several) was rendered with str(list) — a bracketed Python
  repr — whereas the update path already used subsystem_to_str (;-joined). New
  reactions now use subsystem_to_str too, so the two paths agree.
• io/ec_data.py — _eccodes_to_yaml returned its raw input for the ≤1-EC case, so
  a stray trailing ; (or a lone separator) leaked into the written YAML. It now returns
  the cleaned ";".join(parts).
• binaries.py — _safe_extract_zip guarded .. / absolute paths but not symlink
  members, whose target the path check never validates. It now rejects symlink members
  (defence-in-depth; SHA256 + HTTPS already gate the archive).
• binaries.py / data.py — the download urlopen calls had no timeout, so a
  stalled server could hang the process indefinitely. Both now pass a socket timeout.

Tests

One regression test per fix: list-valued subSystems join, _eccodes_to_yaml edge
cases, ZIP symlink rejection, and a urlopen-timeout spy.

Deliberately not changed

The audit also flagged duplicate rxnNames as a silent overwrite. On inspection,
by_signature is built once before the apply loop and not mutated during it, so that
path either creates distinct reactions or hits the existing "overwritten" warning — not a
silent loss. Left as-is.

Verification

pytest (622 passed), ruff check, and mypy (ad-hoc, on the changed sources) all
green. CI mypy enforcement arrives separately with #22.