cmds.secrets: Fix rewrite() of long member names

rewrite() renames the members of a tar blob, but the TarInfo objects
carried over from the input still hold the pax "path" supplement that was
recorded for the original name. Re-serialization (tf_out.addfile()) uses
the pax supplement with higher precedence than what's in the base header's
name filed, so for member names exceeding the 100 character ustar limit the
rewrite silently has no effect and the original name is written back.

Drop the stale "path" supplement after renaming a member. tf_out.addfile()
then builds a rewritten, up-to-date supplement from the name field if it
needs one.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.0.0
Signed-off-by: Jan Lindemann <jan@janware.com>

src/python/jw/pkg/cmds/secrets/lib/tar.py

@@ -40,6 +40,12 @@ def rewrite(blob: bytes, rewrite_filter: Callable[[str], str]) -> bytes:
             new_name = rewrite_filter(info.name)
             log(DEBUG, f'Rewriting {info.name} -> {new_name}')
             info.name = new_name
+            # -- A pax "path" supplement from the input would override
+            #    the rewritten name on re-serialization
+            info.pax_headers = {
+                k: v
+                for k, v in info.pax_headers.items() if k != 'path'
+            }
             buf = tf_in.extractfile(info)
             tf_out.addfile(info, buf)
     return ret.getvalue()