fix(chat): reject path-escaping session keys

[cursor]

Summary

• Fixes a critical path escape where attacker-controlled session_key values were joined into transcript/plan paths. Absolute keys (e.g. /tmp/evil) replace the chat root via Path::join, and ../ keys escape it.
• Adds shared validate_session_key / session_file_under_dir, hardens transcript/plan builders, and fail-closes CLI chat/clear-session, agent-rpc, schedule tick, and executor RPC entry points.
• Adds regression tests proving absolute/traversal keys are rejected before any write outside chat/transcripts or chat/plans.

Bug Impact

• Data write/read outside the chat data root (arbitrary file create/append under process permissions).
• Concrete triggers: skilllite chat / clear-session --session-key '/tmp/…', agent-rpc session_key, schedule.json session_key, executor transcript/plan RPC.

Task Linkage

• Task ID: TASK-2026-074
• Task folder: tasks/TASK-2026-074-session-key-path-safety/

Injected Specs

• spec/verification-integrity.md
• spec/task-artifact-language.md
• spec/security-nonnegotiables.md
• spec/rust-conventions.md
• spec/testing-policy.md
• spec/docs-sync.md (N/A: no documented session-key path grammar; fail-closed validation only)

Validation Evidence

• cargo fmt --all -- --check
• cargo test -p skilllite-core path_validation → 3 passed
• cargo test -p skilllite-executor --lib → 9 passed
• cargo test -p skilllite-agent --lib → 247 passed
• cargo clippy -p skilllite-core -p skilllite-executor -p skilllite-agent --all-targets -- -D warnings → clean
• cargo check -p skilllite-commands → compiles (pre-existing dead_code warning unrelated)
• python3 scripts/validate_tasks.py → passed

Regression Scope

• Chat transcript/plan path construction, schedule session keys, agent-rpc, clear-session.
• Does not address already-open critical PRs (fix(evolution): constrain pending skill path operations #89, Fix Linux sandbox filtered network fail-open #112–Fix Life Pulse rhythm workspace scoping #116, fix(evolution): scope destructive reset to requested workspace #120–fix(security): reject path-escaping skill directory names #125).

Security Review Notes

• What security policy changed, and why is it needed? Session keys must be single-segment before filesystem join.
• Is default behavior more permissive? No — fail-closed.
• Does this affect SKILLLITE_* config semantics? No.
• Were tests and EN/ZH docs updated? Tests yes; docs N/A as above.