fix(config): harden manifest input validation

[joshua-temple]

Problem

Several manifest-supplied values were passed into generated YAML and path joins without charset validation, so a malformed value could reach the generator unchecked.

Fix

Tightens validation on the affected manifest inputs, each with a failing-before/passing-after test:

• Charset-validate action_pins override values (a ref, optionally followed by # <version>); reject anything that could break out of the emitted scalar.
• Reject a path-unsafe action_folder (charset, no separators, no ..), with a defense-in-depth guard in the generator before the path join.
• Reject .. traversal and unsafe characters in local callback workflow paths across all accepted forms (bare filename, .github/workflows/..., and owner/repo/...@ref) via an up-front control/whitespace guard plus positive charsets.
• Add StagePathspec, a manifest-first pathspec allowlist so a future reconcile commit stages an explicit set of paths rather than everything.

Verification

• go build ./..., go test ./... (2382 passed), go test ./... -race, golangci-lint run ./... all clean.
• Independent review passed after two adversarial rounds that closed the remaining input sinks.

Part of #440.