Fix schema-controlled storage path safety

[0xLeif]

Summary

• add one portable SchemaStoragePath abstraction for schema-controlled filesystem access
• reject root aliases, absolute/traversing paths, APS-reserved paths, Windows-reserved names, portable case/Unicode collisions, directories, symlinks, and special files
• route dynamic reads, writes, reset, purge, and encrypted stores through repeated canonical containment checks
• delete only verified regular-file leaves and preserve missing paths as safe no-ops
• document the v1.1.0 safety contract and accept SpecSync requirements REQ-aps-cli-027 and REQ-state-store-020

Root cause

Schema validation previously used string checks and destructive operations appended the schema path directly to the state root. An EncryptedFile path of . could therefore resolve to the root itself, and key remove --purge could recursively delete it.

User impact

Invalid or dangerous storage paths now fail during registration/schema load and again at operation time. Valid nested paths continue to round-trip. The original root-deletion attack is covered in Unix and PowerShell smoke contracts with a sentinel file.

Test plan

• 94 Swift tests pass
• four-worker parallel suite passes
• Unix smoke passes
• PowerShell smoke regression added for Windows CI
• specsync change verify passes with 100% ownership coverage
• fledge trust verify passes after the Linux XCTest compatibility fix; Augur verdict proceed, risk 30

Closes #111

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0311653428

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ad552733c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".