fix(sdk): enforce safe install boundaries

[samzong]

What's changed?

• Validate skill names and host adapter paths before resolving filesystem targets.
• Fail closed on invalid ownership metadata and empty application IDs.
• Stage installs atomically with unique hidden directories and consistent modes across SDKs.
• Extend shared golden cases and runtime gates for unsafe paths, metadata, atomic failure, concurrency, and permissions.

Why

• Prevent path escapes, unsafe overwrite or removal, partial installs, and staging collisions while preserving cross-language parity.

Verification

• node scripts/check.mjs
• TypeScript, Go, Rust, and Python golden suites under umask 077

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0de05c3beb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[samzong]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 595b19875d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".