fix(evolution): constrain pending skill path operations

[cursor]

Summary

• Fixes a critical path traversal bug in pending skill read/confirm/reject paths where skill_name was joined directly under _evolved/_pending.
• Adds a shared single-segment pending skill name validator in skilllite-evolution, applies it to mutating operations and desktop SKILL.md reads, and keeps valid pending skill confirm/reject behavior unchanged.
• Adds regression tests proving absolute-path deletion and .. movement attempts are rejected while out-of-scope directories survive.

Task Linkage

• Task ID: TASK-2026-067
• Task folder: tasks/TASK-2026-067-pending-skill-path-safety/

Injected Specs

• spec/architecture-boundaries.md (reviewed; no boundary changes)
• spec/security-nonnegotiables.md (security fix)
• spec/testing-policy.md (Rust code change)
• spec/docs-sync.md (reviewed; no docs needed because no user-facing command/env/policy wording changed)

Validation Evidence

• Commands executed:
  • cargo test -p skilllite-evolution pending_skill -- --nocapture
  • cargo test -p skilllite-evolution
  • cargo test -p skilllite-commands
  • cargo fmt --check
  • cargo clippy --all-targets -- -D warnings
  • cargo test
  • python3 scripts/validate_tasks.py
• Key results:
  • Focused traversal tests: 3 passed; 0 failed; 94 filtered out
  • skilllite-evolution: 97 passed; 0 failed
  • skilllite-commands: 23 passed; 0 failed
  • Full workspace cargo test: passed
  • Task validation: Task validation passed (67 task directories checked)
  • Environment note: first validation attempt was blocked by Cargo 1.83 lacking edition 2024 support; updated stable toolchain to Rust/Cargo 1.96 per AGENTS.md, then validation passed.

Regression Scope

• Areas likely affected:
  • skilllite evolution confirm|reject
  • Desktop evolution pending skill read/confirm/reject bridge
  • skilllite-evolution pending skill filesystem operations
• Explicit non-goals:
  • No pending skill storage redesign
  • No command name or JSON output shape changes
  • No broader evolution policy changes

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
• Files:
  • N/A

Review Checklist

• Acceptance criteria in tasks/TASK-2026-067-pending-skill-path-safety/TASK.md satisfied
• tasks/TASK-2026-067-pending-skill-path-safety/STATUS.md updated with latest progress
• tasks/TASK-2026-067-pending-skill-path-safety/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date