* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
* Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
Introduce --ask-become-pass or -K to support password-required sudo on remote hosts, just like Ansible.
It will also fall back to this prompt if a password is required but the arg wasn't passed in.
With thanks to slhck from HN for the initial patch, advice and feedback.
