v0.5.2

Security

• Confine handleRunStart config/scenario paths — the /api/run/start endpoint now restricts config and scenario paths to their respective directories via sanitizeConfigFilename + filepath.Join, matching all other file-handling endpoints. Previously accepted arbitrary filesystem paths.
• Normalize Packs tab esc() function — add single-quote escaping to match all other esc() implementations in app.js.

See CHANGELOG.md for details.