[Tracking] Cowork hardening — exit criteria for promoting cowork out of experimental

[sergio-sisternes-epam]

Tracking issue grouping all follow-ups required to promote the cowork experimental flag to GA. Spun out of #913 (cowork-skills experimental support) following the APM Expert Review Panel verdict.

The PR for #913 (#926) ships behind experimental.cowork=false by default. CEO arbitration accepted the items below as follow-ups behind the flag, but all security items in #925 are hard gates on flipping the flag default to true or removing it from FLAGS.

Exit criteria for GA

Security (BLOCKING)

• Cowork security follow-ups — gate on promoting cowork out of experimental #925 — Cowork security follow-ups (orphan cleanup on uninstall, NUL-byte / traversal validation in set_cowork_skills_dir, replace ad-hoc .. substring with validate_path_segments)

Security (tracking, non-blocking)

• Track %2e%2e URL-encoded traversal in lockfile-path handling #924 — %2e%2e URL-encoded traversal in lockfile-path handling (mitigated today by ensure_path_within; cleaner fix is to reject at parse time)

Maintainability (non-blocking, recommended)

• Cowork internal refactors — DRY and hot-path cleanup #922 — Internal refactors: route SkillIntegrator through target.deploy_path(), dedupe hot-path resolve_cowork_skills_dir() calls, consolidate unset_*_dir helpers behind update_config()
• Cowork diagnostic polish — hide experimental key and fix verbose log #923 — Diagnostic polish: gate cowork-skills-dir in _valid_config_keys(), fix verbose target log to print resolved root instead of placeholder

Documentation gate

Before flipping the flag default:

• Refresh docs/src/content/docs/security-model.mdx to reflect that cowork writes into a surface ingested by M365 Copilot.
• Move cowork from docs/src/content/docs/reference/experimental-flags.mdx into the standard install/targets reference.
• Update CHANGELOG with promotion notice and any behavioural deltas vs the experimental version.

Out of scope for this tracker

• Adding new cowork-host targets beyond M365 Copilot (separate proposal).
• Cross-platform OneDrive resolver hardening for Linux (no current path).

How to close

Close this issue once #925 is closed, the documentation gate items are checked, and the cowork entry is removed from FLAGS in src/apm_cli/core/experimental.py. #922, #923, #924 do not block closure but should be linked in the closing comment with their final state.

/cc panel review: #913, PR: #926