fix: validate worktree paths to prevent traversal (#419)

[kexi]

Summary

Fixes a High-severity path traversal vulnerability in git worktree operations. createWorktree / removeWorktree previously passed worktreePath directly to git worktree add/remove without traversal validation. The existing validatePath only blocked null bytes / newlines / $() / backticks, leaving ../, leading -, and control characters as viable attack vectors via a malicious path_script, hook stdin payload, or compromised config.

A new validateWorktreePath helper is applied at both source (resolveWorktreePath, stdin hook input) and sink (createWorktree, removeWorktree, getCreateWorktreeCommand, and clean.ts's local removeWorktree wrapper) for defense-in-depth. Error messages escape control characters to prevent ANSI-escape injection in logs, and the dry-run command formatter now uses escapeShellPath so embedded quotes can't produce broken shell strings.

Symlink resolution and an allowlist of permitted roots (worktree.allowedRoots) are deferred — the SECURITY_CHECKLIST docs note this scope explicitly.

Related issues: #417 (symlink attacks) and #415 (env-var injection in path_script) sit in the same neighborhood and should be tracked separately.

Test Plan

• Added 26 unit tests in worktree-path-validation.test.ts covering accept paths, rejected forms (.., leading -, control chars, Windows drive-relative / long-path / UNC), and error-message control-char escaping.
• Added 15 tests in services/worktree/operations.test.ts asserting validation runs before runGitCommand is invoked, that the canonical (normalized) path reaches git, and that getCreateWorktreeCommand escapes single quotes safely.
• Extended worktree-path.test.ts with regressions for path_script outputs containing .., leading -, and trailing slashes.
• Extended stdin.test.ts with hook-payload regressions; rejection now emits warnLog so attempted injections are observable.
• pnpm run lint, pnpm run fmt:check, pnpm run check (tsc): all clean.
• Ran the full test suite — only failure is the pre-existing flaky settings.test.ts > Hash history FIFO (filesystem timing race; passes 16/16 in isolation; not touched by this PR).

Checklist

• Tests added/updated
• pnpm run check:all passes (sole failure is the pre-existing flaky settings.test.ts FIFO test, unrelated to this PR; verified by running it in isolation)
• Docs updated (docs/SECURITY_CHECKLIST.md and .ja.md §2)

Fixes #419