feat: validate_pr reads an undeclared ZIP's files

A card's BIOS folder zipped to upload it was hashed as one file and
reported not recognised, its contributor asked where the dump came from
and told to place it under bios/. A ZIP no list or profile declares as a
whole is now read member by member: each is named held, declared and not
held, or not recognised, and the contributor is asked for the files
unzipped. A declared archive (a MAME or FBNeo set) is never opened.

tests/test_validate_pr.py

@@ -269,6 +269,29 @@ class HashRecognition(_Fixture):
         self.assertIn("no platform list or emulator profile declares this file", markdown)
         self.assertIn("which emulator reads it", markdown)
 
+    def test_a_zip_of_bios_files_is_read_member_by_member(self):
+        """A card's BIOS folder zipped to upload it was hashed as one file,
+        and its contributor was asked where that dump came from."""
+        import hashlib  # noqa: PLC0415
+        import zipfile  # noqa: PLC0415
+
+        held, declared = b"HELD BIOS", b"DECLARED BIOS"
+        with zipfile.ZipFile(self.tmp / "mybios.zip", "w") as archive:
+            archive.writestr("scph5501.bin", held)
+            archive.writestr("sub/declared.bin", declared)
+            archive.writestr("other.bin", b"noise")
+        db = {"files": {hashlib.sha1(held).hexdigest(): {"path": "bios/Sony/PS/scph5501.bin"}}}
+        known = {**EMPTY_HASHES, "md5": {hashlib.md5(declared).hexdigest()}}
+        result = validate_pr.validate_file("mybios.zip", db, known)
+        markdown = result.to_markdown()
+        self.assertEqual(result.outcome, "unknown")
+        self.assertIn("unzipped, not the archive", markdown)
+        self.assertIn("`scph5501.bin` already held at `bios/Sony/PS/scph5501.bin`", markdown)
+        self.assertIn("`sub/declared.bin` declared and not held", markdown)
+        self.assertIn("`other.bin` not recognised", markdown)
+        self.assertNotIn("where the dump comes from", markdown)
+        self.assertNotIn("Place it in", markdown)
+
     def test_a_duplicate_of_a_known_file_is_reported(self):
         """A copy of a held file passed, and was sent to the folder that
         already holds it."""