Refuse project skill installs into the filesystem root

[jamie-at-bunny]

Follow-up to #174. Project skill installs already refuse the home directory, since per-user config dirs like ~/.claude would read as project markers there. The filesystem root is the same class of mistake and was still allowed, so bunny skills install run from / would write /AGENTS.md and /.agents/skills/bunny-cli/ on any writable root.

What changed

• assertNotHome becomes assertProjectDir, covering both non-project locations behind one guard.
• New isFilesystemRoot helper: resolves the path first, then tests whether it is its own parent, so a symlinked path cannot dodge the check. Uses the existing dirname import rather than pulling in parse.
• Test, install.ts docstring, AGENTS.md, and a changeset.

Why this was not caught before

The audit that surfaced it ran on macOS, where / is read-only, so the install failed with EROFS rather than succeeding. On Linux as root it would have landed. The damage was cosmetic, not destructive: no recursive delete is involved and nothing outside the two fixed path suffixes is ever touched.

Reviewer notes

• The guard fires before any write, so a refused install leaves nothing behind. The existing home-directory test asserts this via readdirSync(cwd) being empty; the new root test asserts the message only, because / is not ours to inspect.
• Verified the new test fails without the guard, so it is a real regression test rather than a passing assertion.
• Removal is deliberately not guarded here. It stays permitted in these locations so a stray AGENTS.md from an earlier version can still be cleaned up, matching the home-directory behaviour established in Skills install scope #174.

Checks

• bun test: 907 pass, 1 skip, 0 fail
• bun run lint: clean

[changeset-bot]

🦋 Changeset detected

Latest commit: a464292

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@bunny.net/cli	Patch
@bunny.net/cli-linux-x64	Patch
@bunny.net/cli-linux-arm64	Patch
@bunny.net/cli-darwin-x64	Patch
@bunny.net/cli-darwin-arm64	Patch
@bunny.net/cli-windows-x64	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[bunnynet-devops]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.