Harden ContextZIP path and filename safety

[junjunjunbong]

Summary

• constrain output and manifest paths to safe, non-overlapping locations under .contextzip
• validate paths before dry-run completion, deletion, copying, or manifest writes
• keep flattened collision names within the 240-byte UTF-8 limit
• add Codex UI metadata and document the strengthened safety contract
• expand coverage from 8 to 23 tests

Why

Custom manifest paths were resolved without the same containment checks as output paths, so a user-supplied path could escape .contextzip, overwrite a project file, or place the manifest inside the upload folder. Collision suffixes were also appended after the filename length check, which could produce names longer than the declared 240-byte limit.

Impact

Default pack behavior remains unchanged. Unsafe or overlapping custom paths now fail before filesystem mutation, and long or colliding filenames remain deterministic and upload-safe.

Validation

• python -m unittest discover -s tests -v on Python 3.10.20: 23 passed
• python -m unittest discover -s tests -v on Python 3.12.13: 23 passed
• git diff --check
• skill validation passed
• end-to-end pack and independent forward test verified byte-preserving SHA-256 integrity and sensitive .env* exclusion