fix(xtask): validate the workspace root at its source (CodeQL path-injection alert)

[MatejGomboc]

Summary

Addresses the repository's one open GitHub security alert: CodeQL rust/path-injection (high) at xtask/src/main.rs:244, where CARGO_MANIFEST_DIR flows into the constructed kernel-image path. No Dependabot or secret-scanning alerts exist.

Explanation for the maintainer

The alert is a genuine taint flow but a false positive as a risk: cargo itself sets CARGO_MANIFEST_DIR, every joined component after the root is a fixed string, and xtask runs with the invoker's own authority — whoever controls that environment already runs arbitrary code as that user. Rather than dismissing, this makes the validation real: workspace_root() canonicalises the path and verifies it holds the workspace Cargo.toml (a mangled environment now fails at the source with a message naming the problem), and build() asserts the image path's containment under the root — the guard shape CodeQL documents for this query — rather than assuming it. The trust model is stated in a doc comment so the next reader does not re-litigate it.

CodeQL runs on this PR, so whether this shape clears the alert is answered empirically. If the alert survives, the remaining step is dismissing it with the trust-model rationale — that is alert triage on GitHub, so it is yours, not mine. Behavioural note: canonicalisation on Windows yields a \?\-prefixed path; harmless for cargo and the CRT, visible only in printed paths on a Windows host.

Which pillar does this serve?

Toil (tooling hygiene), with the fail-closed instinct the rest of the tree follows.

Borrow Ledger

• I checked the Borrow Ledger (CONSTITUTION.md §4) for this subsystem
• The verdict for this subsystem is: write ourselves (build tooling)
• Vendored code retains its original licence notices; new files carry an SPDX header (no files added)

unsafe register

• New unsafe blocks: None
• Every new unsafe block carries a // SAFETY: comment (n/a)
• Every unsafe block is inside a module CLAUDE.md designates for it (n/a)
• I have listed them in the session summary / PR description above

Checklist

• Builds for both Tier-1 targets — kernel untouched; CI re-proves it
• Clippy passes for every package, exactly as CI runs it (xtask clean under -D warnings; others untouched)
• Formatted (cargo fmt --all --check)
• Toolchain pins agree
• British spelling
• Markdown is lint-clean (CHANGELOG entry)
• Boots in QEMU where applicable — CI's boot jobs gate it
• CHANGELOG.md updated under [Unreleased]
• Commit messages follow Conventional Commits
• Commit GPG-signed

Related

GitHub code-scanning alert #1.

🤖 Generated with Claude Code