pub fn check_quarantine(path: &Path) -> (bool, Option<String>)
Read the quarantine xattr to detect downloaded files. Returns (is_downloaded, download_source).