Fix skill script path traversal

[8421bit]

Summary

• Add skills-directory path guards for skill execution paths.
• Block skillName and scriptFile traversal before filesystem access.
• Reuse the guard for skill create/delete, skill content reads, and sandbox validation.
• Execute skill scripts with execFile instead of shell-built command strings.
• Add regression tests for the reported traversal pattern and related boundary cases.

Fixes #5.

Verification

• npm test
• npm run build