feat(discovery): STACKS_ROOT path safety check

internal/discovery/pathcheck.go

@@ -0,0 +1,23 @@
+package discovery
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// IsInsideRoot reports whether path is the same as, or nested inside,
+// root. Both are cleaned before comparison so trailing slashes, "."
+// segments, and ".." escapes are handled. Prefix tricks like
+// "/foo" vs "/foo-evil" are NOT considered inside.
+func IsInsideRoot(root, path string) bool {
+	r := filepath.Clean(root)
+	p := filepath.Clean(path)
+	if p == r {
+		return true
+	}
+	rel, err := filepath.Rel(r, p)
+	if err != nil {
+		return false
+	}
+	return !strings.HasPrefix(rel, "..")
+}