runner.aws_batch: Restore times on actually-extracted path…

…not our presumed extraction path.  This is a nuanced change: normally
the two paths are identical, but zipfile.extract() does sometimes munge
extraction paths for security or platform compatibility and thus make
the two paths different.

CHANGES.md

@@ -53,6 +53,12 @@ development source code and as such may not be routinely kept up to date.
   known users of non-nextstrain.org remotes were also unaffected.
   ([#419][])
 
+* File timestamps for results files downloaded from an AWS Batch build are now
+  correctly restored even if the expected extraction path differs from the
+  actual extraction path due to ZIP security precautions.  This bug likely
+  affected approximately no one.
+  ([#419][])
+
 ## Development
 
 * Goodbye, Mypy!  We now use only Pyright for type checking.  Both type

nextstrain/cli/runner/aws_batch/s3.py

@@ -152,13 +152,13 @@ def download_workdir(remote_workdir: S3Object, workdir: Path, patterns: List[str
                     if member.CRC != crc32(workdir / path):
                         print("unzipping:", workdir / path)
 
-                        zipfile.extract(member, str(workdir))
+                        extracted = zipfile.extract(member, str(workdir))
 
                         # Update atime and mtime from the zip member; it's a
                         # bit boggling that .extract() doesn't handle this,
                         # even optionally.
                         mtime = zipinfo_mtime(member)
-                        utime(str(workdir / path), (mtime, mtime))
+                        utime(extracted, (mtime, mtime))
 
 
 def walk(path: Path, excluded: PathMatcher = lambda x: False) -> Generator[Path, None, None]: