fix(memory): reject path-escaping memory rel_path values

[cursor]

Summary

• Fixes a critical path escape where executor/stdio memory_write joined caller-controlled rel_path under <chat_root>/memory/ after only checking contains("..") / starts_with('/'). On Windows, drive-absolute and backslash-rooted values (e.g. C:/Temp/pwn.md, \Windows\Temp\pwn.md) replace the memory root via Path::join and write outside the chat tree.
• Adds shared validate_memory_rel_path / memory_file_under_dir in skilllite-core, wires them into executor RPC write + markdown reindex, and keeps nested / relatives like notes/day.md working.
• Adds regression tests for drive / backslash / absolute / traversal reject paths and nested accept path.

Bug Impact

• Arbitrary file create/overwrite outside <chat_root>/memory/ under process permissions on Windows hosts.
• Concrete trigger: stdio RPC memory_write with rel_path: "C:/Temp/pwn.md" (or \\Windows\\Temp\\pwn.md) and any content.

Task Linkage

• Task ID: TASK-2026-077
• Task folder: tasks/TASK-2026-077-memory-rel-path-safety/

Injected Specs

• spec/verification-integrity.md
• spec/task-artifact-language.md
• spec/security-nonnegotiables.md
• spec/rust-conventions.md
• spec/testing-policy.md
• spec/docs-sync.md (N/A: fail-closed validation only; no user-facing path grammar docs)
• spec/architecture-boundaries.md (reviewed; no boundary changes)

Validation Evidence

• Commands executed:
  • cargo fmt --all -- --check → clean
  • cargo test -p skilllite-core path_validation → 3 passed
  • cargo test -p skilllite-executor --lib → 6 passed
  • cargo clippy -p skilllite-core -p skilllite-executor --all-targets -- -D warnings → clean
  • python3 scripts/validate_tasks.py → passed (71 task directories)
• Key results:
  • C:/Temp/pwn.md, \Windows\Temp\pwn.md, /tmp/pwn.md, ../escape.md rejected before write
  • Nested notes/day.md still written under chat/memory/

Regression Scope

• Areas likely affected:
  • Executor memory_write RPC and memory markdown reindex filtering
• Explicit non-goals:
  • Open PR fix(memory): reject path-escaping agent IDs #128 agent_id hardening (lands separately)
  • Agent workspace symlink follow
  • Other open critical PRs (fix(evolution): constrain pending skill path operations #89, Fix Linux sandbox filtered network fail-open #112–Fix Life Pulse rhythm workspace scoping #116, fix(evolution): scope destructive reset to requested workspace #120–fix(evolution): reject path-escaping skill entry points #127)

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
  Files:
  • N/A

Security Review Notes

• What security policy changed, and why is it needed? Memory note relative paths must stay under memory/ even when Windows join semantics replace roots.
• Is default behavior more permissive? No — fail-closed.
• Does this affect SKILLLITE_* config semantics? No.
• Were tests and EN/ZH docs updated? Tests yes; docs N/A as above.

Review Checklist

• Acceptance criteria in tasks/TASK-2026-077-memory-rel-path-safety/TASK.md satisfied
• tasks/TASK-2026-077-memory-rel-path-safety/STATUS.md updated with latest progress
• tasks/TASK-2026-077-memory-rel-path-safety/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date