v0.3.1 — pre-launch security and CLI fixes

v0.3.1 — 2026-09-03

Pre-launch security pass over adapt, the runs root and the shell sandbox. Hostile input
here means a repository you point upshift adapt at, and the model output it steers.

• adapt refuses a source that git would read as an option (--upload-pack=…/x.git and
  friends) and clones with -- terminating option parsing.
• The repo walk skips any path that resolves outside the repository root, so a checked-in
  symlink can no longer pull ~/.ssh/id_rsa or /etc/passwd into the evidence sent to the
  model. (The pointer-following round already resolved paths against the root.)
• The generated backend.py escapes everything interpolated into its header docstring —
  origin, commit, and the model-written tool names and citations — and the rendered file is
  parsed before it is written. A repo whose text contains """ can no longer place
  statements in a file upshift upgrade imports and runs.
• --tag and case ids are validated as single directory names, so everything upshift writes
  (and everything the repair loop replaces) stays under the runs root.
• shell_gpt sandbox: added --memory 512m and --security-opt no-new-privileges.
• A hostile integer literal in a target repo no longer aborts adapt with an uncaught
  ValueError from CPython's int-to-string digit limit.
• New tests/test_security.py pins all of the above; pip-audit clean.