[feat] build private env wheel in cache

[Jackmin801]

Note

Implements private environment installation via local build-and-cache with security hardening and tests.

• Private envs: pull source (package_url), resolve version from pyproject.toml, build wheel, cache at ~/.prime/wheel_cache/{owner}/{name}/{version}/dist, then install from cache; reuses cached wheel on subsequent installs; supports uv/pip and --no-upgrade.
• New helpers: _pull_and_build_private_env, _safe_tar_extract, _get_env_cache_dir, _validate_path_component, _get_version_from_pyproject.
• Security: safe tar extraction blocks absolute paths, .., symlinks, and hardlinks; validates cache paths and components to prevent traversal.
• Tests: end-to-end private env install/cache reuse and unit tests for path component validation and tar extraction safety.

^{Written by Cursor Bugbot for commit 4de6244. This will update automatically on new commits. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3aa4f28c13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}