fix(artifact): reject Windows path escapes in store keys

[cursor]

Summary

• Reject Windows drive-absolute and backslash-rooted artifact key / run_id values that previously passed Unix-oriented validation and escaped the store root via Path::join on Windows.
• Add a post-join containment check in LocalDirArtifactStore so resolved paths must remain under <base>/artifacts.
• Add regression coverage for C:\..., C:/..., and \Windows\Temp-style inputs while keeping / hierarchical keys working.

Task Linkage

• Task ID: TASK-2026-071
• Task folder: tasks/TASK-2026-071-artifact-windows-path-escape/

Injected Specs

• spec/architecture-boundaries.md
• spec/security-nonnegotiables.md
• spec/testing-policy.md
• spec/docs-sync.md

Validation Evidence

• Commands executed:
  • cargo fmt --check
  • cargo test -p skilllite-core artifact_store
  • cargo test -p skilllite-artifact
  • cargo test
  • cargo clippy -p skilllite-core -p skilllite-artifact --all-targets -- -D warnings
  • cargo clippy --all-targets -- -D warnings -A clippy::question_mark -A clippy::useless_borrows_in_formatting
  • python3 scripts/validate_tasks.py
• Key results:
  • Core artifact_store tests: 10 passed (including Windows drive/backslash rejection).
  • skilllite-artifact tests: 26 passed.
  • Full workspace cargo test: passed.
  • Changed-crate Clippy clean under -D warnings.
  • Workspace Clippy passes when allowing the two pre-existing unrelated lints in skilllite-commands (question_mark, useless_borrows_in_formatting).
  • Task validation: 71 task directories checked.

Regression Scope

• Areas likely affected:
  • Artifact key/run_id validation and local filesystem path construction.
  • Artifact HTTP put/get validation (same validators).
• Explicit non-goals:
  • Auth/token policy for artifact-serve.
  • Symlink follow-out after a legitimate in-root path.
  • Evolution pending-skill path traversal (already tracked in open PR fix(evolution): constrain pending skill path operations #89).

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
• Files:
  • N/A; keys remain relative /-separated paths as previously documented.

Review Checklist

• Acceptance criteria in tasks/TASK-2026-071-artifact-windows-path-escape/TASK.md satisfied
• tasks/TASK-2026-071-artifact-windows-path-escape/STATUS.md updated with latest progress
• tasks/TASK-2026-071-artifact-windows-path-escape/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date