Document report boundary validation

Record the URL-segment and repository-path normalization guards enforced before report artifacts are accepted.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: juliamuiruri4

.github/agentic-refresh/report-contract.md

@@ -18,6 +18,9 @@ Every quest run first emits one version 1 JSON artifact with:
 A completed report must include source fingerprints. A blocked report must state
 one concise reason and cannot propose changes. A no-change report cannot propose
 changes. Invalid or missing quest artifacts become blocked scopes in the digest.
+Source and path validation rejects adjacent URL-prefix matches, absolute paths,
+backslashes, normalization changes, and traversal segments before materializing
+an artifact.
 
 A child plan must contain: