feat: add bounded MSZIP cabinet extraction

tests/fixtures/README.md

@@ -47,9 +47,33 @@ They are MIT-licensed; the exact upstream text is in
 `LICENSES/rust-cab-MIT.txt`.
 
 The arrays cover an uncompressed single-entry CAB, an uncompressed two-entry
-CAB, and an LZX `0x1303` CAB containing `hi.txt` and `bye.txt`. They are CAB
-unit fixtures, not OneNote exports, and are not evidence of `.onepkg` producer
-compatibility.
+CAB, a single-block MSZIP CAB, and an LZX `0x1303` CAB containing `hi.txt` and
+`bye.txt`. They are CAB unit fixtures, not OneNote exports, and are not evidence
+of `.onepkg` producer compatibility.
+
+## Inline generated two-block MSZIP fixture
+
+`src/onenote/onepkg/cabinet.test.ts` also contains a generated 593-byte CAB
+with one 36,864-byte `history.bin` entry. The input byte at index `i` is
+`i % 251`. It is split into a 32,768-byte block and a 4,096-byte block; the
+second raw DEFLATE stream uses the first block as its preset 32 KiB dictionary,
+so decoding it without folder history fails.
+
+- Generator: CPython 3.13.14 `zlib.compressobj`, zlib 1.3.1, raw DEFLATE
+  (`wbits=-15`), level 9; the second call uses `zdict=first_block`. Each stream
+  is prefixed with `CK` and placed in a spec-shaped single-folder CAB with CAB
+  checksums.
+- Generator invocation: `python3` with the documented deterministic input and
+  CAB layout above; the frozen Base64 bytes, sizes, checksums, and hashes are
+  asserted by the test. No notebook or third-party content is an input.
+- CAB SHA-256:
+  `9f71b97623395492f401ddc152ca648e8416996b14092b0df42ad712c27f9cb2`.
+- Extracted SHA-256:
+  `cb441d1f6e7d9c5789a306c51a00a654c9b7715c2c3d624e3d2a75bd0af549ff`.
+- Licence: original test data under this project's MPL-2.0 licence.
+
+This fixture establishes block-history behavior only. It is not a OneNote
+export and is not evidence of `.onepkg` producer compatibility.
 
 ## Distribution policy
 

tests/release-archive.test.ts

@@ -94,6 +94,9 @@ describe('release archive', () => {
     expect(
       createHash('sha256').update(files['LICENSES/lzxd-MIT.txt']!).digest('hex')
     ).toBe('c7a1dcbf839b1dfb72f24e1de12ab55f789db2c61d894ca9aa8b5f595490d9ca');
+    expect(
+      files['LICENSES/THIRD-PARTY-LICENSES.txt']!.toString('utf8')
+    ).toContain('fflate@0.8.3');
     expect(files).not.toHaveProperty(
       'tests/fixtures/joplin-test.onepkg.base64'
     );