Harden install path validation with filesystem-aware checks and cross-platform security tests

[lufftw]

Summary

This PR refactors path validation to use path.relative() and fixes
Windows compatibility issues.

Problem

The original validation logic had two issues:

1. Windows incompatibility: Hardcoded '/' separator caused false
   rejections of valid installs on Windows

2. Code clarity: String-based startsWith() check is less clear
   than filesystem-aware path.relative()

Non-issue: Path Traversal

The existing code is already safe from path traversal attacks because:

• All skill names pass through basename() which strips ../
• All paths are constructed with join(targetDir, basename(...))
• This prevents any directory escapes

The tests added in this PR demonstrate hypothetical attack scenarios
if the code were written differently, but these scenarios don't
reflect actual exploitable vulnerabilities in the current implementation.

Solution

Use path.relative() for clearer intent and cross-platform compatibility:

const relative = path.relative(resolvedTargetDir, resolvedTargetPath);
if (relative.startsWith("..") || path.isAbsolute(relative)) {
  throw new Error("Installation path outside target directory");
}

Impact

• ✅ Fixes Windows installation failures (primary benefit)
• ✅ Improves code maintainability and clarity
• ✅ Adds comprehensive test coverage for edge cases
• ℹ️ No actual security vulnerabilities fixed (code was already safe)