This updates the tar implementation to use nanotar instead of tar-stream while preserving the existing compressing.tar API and extraction behavior. The change keeps tar/tgz/zip integration intact, including the existing path traversal and symlink protections.

• Dependency change

  • Replace the runtime tar-stream dependency with nanotar.

• Tar archive creation

  • Add a shared tar archive helper for tar creation.
  • Route tar.Stream and tar.FileStream through the new helper without changing the public API.
  • Preserve entry metadata used by the package today, including file mode handling.

• Tar extraction compatibility

  • Add a small internal tar parser used by tar.UncompressStream.
  • Preserve entry event semantics expected by the existing extraction pipeline.
  • Keep security-sensitive extraction behavior unchanged for:
    • path traversal rejection
    • symlink escape rejection
    • existing symlink path validation

• Cross-format compatibility

  • Restore TarStream subclass initialization so zip.Stream continues to work correctly after the tar refactor.

• Coverage updates

  • Reuse the new tar helper in test utilities.
  • Add a tar compressDir round-trip assertion to verify the new archive generation path.

Example of the unchanged public surface:

const compressing = require('compressing');

await compressing.tar.compressDir('/path/to/dir', '/tmp/archive.tar');
await compressing.tar.uncompress('/tmp/archive.tar', '/tmp/out');