I've had more luck with "open directories" than zip files. Create a directory (src/mdout/etc.), put the package.xml file in the directory at the top level, and create subfolders if needed for "objects", "permissionsets", "classes", etc. Make sure the package.xml is formatted correctly (no mismatches, no extra spaces). There are package.xml examples here.
sfdx force:mdapi:deploy -d -w 3 -u
My easiest option right now is to use the package.xml file to pick and choose what files I pull out. Using a temporary package is nice, and finds dependencies, but I find that I have more flexibility with packages
sfdx force:mdapi:retrieve -r -w 3 -k
/package.xml -u