security: add path traversal protection to installers

[asharijuang]

Summary

• Add input sanitization (validate_safe_name / validate_safe_path) for skill names and file paths in install.sh and install.ps1
• Prevents path traversal attacks via malicious GitHub API responses or crafted skill names (e.g. ../../.ssh/authorized_keys)
• Add SECURITY.md with contributor security checklist and recommended secure installation method
• Add security note in README.md installation section

Vulnerabilities Addressed

• Path traversal via skill names: Skill names from GitHub API were used directly in rm -rf, cp -R, mkdir -p, and curl -o without validation. A compromised repo could inject names like ../../etc to write/delete files outside the target directory.
• Path traversal via file paths: Relative file paths from the GitHub tree API were passed to file operations without checking for .. sequences or absolute paths.

Changes

File	What
install.sh	Added validate_safe_name() and validate_safe_path() functions, applied at 4 code paths
install.ps1	Added Test-SafeName and Test-SafePath functions, applied at skill listing and file install
SECURITY.md	New file — reporting policy, security model, contributor checklist
README.md	Added security note pointing to SECURITY.md

Test plan

• Run ./install.sh locally — verify normal skill installation still works
• Run install.ps1 on Windows — verify normal installation still works
• Verify skill names with special characters (e.g. ../test, foo bar) are rejected with error message