feat: add bounded Quantum cabinet extraction

docs/SECURITY.md

@@ -58,8 +58,9 @@ The CAB/package path applies these defaults:
 | Total extracted entry bytes     |        512 MiB |
 | Folder compression ratio        |          200:1 |
 | One MSZIP compressed block      |  32 KiB + 12 B |
+| Quantum window                  |          2 MiB |
 | LZX window                      |          8 MiB |
-| LZX decode operations           |  1,000,000,000 |
+| LZX/Quantum decode operations   |  1,000,000,000 |
 
 A CFDATA block may declare at most 32 KiB of output. Counts and offsets use
 checked arithmetic and bounded readers. The CAB parser verifies supplied block
@@ -71,8 +72,12 @@ MSZIP checks its `CK` framing and raw DEFLATE data, writes into a fixed caller
 buffer with one overflow-detection byte, requires the exact declared output
 size, and retains no more than 32 KiB of history. LZX checks its window, Huffman
 trees, block sizes, match ranges, output size, and operation budget. CAB
-extraction checks cancellation and yields between data blocks so the worker can
-process termination. Desktop OneStore traversal checks fragment/reference
+Quantum limits its window, model scans, arithmetic renormalisation, matches,
+frame/output boundaries, operation count, and trailer padding. It queues at
+most the current and next compressed block so a synthetic `0xFF` sentinel can
+be consumed without buffering a complete folder. CAB extraction checks
+cancellation during Quantum work and yields between data blocks so the worker
+can process termination. Desktop OneStore traversal checks fragment/reference
 cycles, nesting, object/property/reference counts, and byte ranges.
 
 ## Rendering and links