fix: address security vulnerability and task dependency inconsistency

[hobostay]

Summary

This PR fixes two issues in the codebase:

1. Security: Path Traversal Vulnerability in SkillLoader

Problem: Entry names from directory listing were not validated before being used in path construction. This could allow path traversal attacks if a directory entry contained special characters like ...

Impact: An attacker with ability to create directories in the skills directory could potentially read files outside the intended directory.

Fix: Added validation to reject entries containing:

• Path separators (/ or \)
• Dot prefixes (hidden files or parent directory references like . or ..)

// Before
let skillFile = "\(directory)/\(entry)/SKILL.md"

// After  
guard !entry.contains("/"),
      !entry.contains("\\"),
      !entry.hasPrefix(".")
else {
  continue
}

let skillFile = "\(directory)/\(entry)/SKILL.md"

2. Correctness: Asymmetric Task Dependencies in TaskManager

Problem: When adding blockedBy or blocks relationships, if the referenced task didn't exist, the relationship was only maintained one-way. This led to inconsistent state.

Example of the bug:

• Task 1 sets addBlockedBy: [2]
• Task 1 now has blockedBy: [2]
• But Task 2 doesn't have blocks: [1] (because Task 2's file doesn't exist or failed to load)
• The dependency graph is now inconsistent

Fix: Changed the behavior to:

1. Throw taskNotFound error when the referenced task doesn't exist
2. Revert any partial changes to maintain state consistency
3. Only update the bidirectional relationship if both tasks exist

Testing

• Project builds successfully with swift build
• No new tests added as the existing test framework has dependency issues (requires Swift 6 Testing module)

Checklist

• All changes build successfully
• Code follows existing style conventions
• Commit messages are clear and descriptive
• Security fix properly validates input

🤖 Generated with Claude Code