Prevent path traversal in --coverage-dir argument

[bartveneman]

Summary

Add path traversal protection to the --coverage-dir CLI argument to ensure coverage directories cannot escape the current working directory.

Key Changes

• Path validation: Modified CoverageDirSchema to resolve relative paths and validate they stay within the current working directory
• Absolute path resolution: All --coverage-dir values are now resolved to absolute paths using resolve()
• Security check: Added validation to reject paths that attempt to traverse outside the current working directory (e.g., ../../etc, ../sibling)
• Test coverage: Updated existing test to use relative paths and added two new tests to verify path traversal attempts are rejected

Implementation Details

The validation uses process.cwd() as the security boundary. Paths are accepted only if they:

1. Equal the current working directory exactly, or
2. Start with the current working directory followed by a path separator

This prevents directory traversal attacks while still allowing relative paths like coverage or ./path/to/coverage that resolve within the project.

https://claude.ai/code/session_01SoGLdxJCSsRPACjf6uLuyR

closes #75

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.52%. Comparing base (3941a07) to head (e727bb3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #78      +/-   ##
==========================================
+ Coverage   96.49%   96.52%   +0.03%     
==========================================
  Files          14       14              
  Lines        1026     1035       +9     
  Branches      118      120       +2     
==========================================
+ Hits          990      999       +9     
  Misses         34       34              
  Partials        2        2              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codecov-commenter]

Bundle Report

Changes will increase total bundle size by 174 bytes (0.66%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
cli.js-esm	13.8kB	174 bytes (1.28%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: cli.js-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
cli.mjs	174 bytes	13.8kB	1.28%

Files in cli.mjs:

• ./src/cli/arguments.ts → Total Size: 1.81kB