Complete default-branch CodeQL remediation

[ChelseaKR]

Summary

• validate record identifiers at every archive path boundary and keep response filenames literal
• remove the configuration/lockdown/ingest import cycle
• replace remaining oversized XML regexes and the WebVTT voice regex with linear parsing
• clear mixed-return, unreachable, repeated-import, catch-base-exception, and implicit-concatenation findings

Verification

• ruff
• mypy
• 199 focused regression tests