fix(sourceconfig): reject unsafe source paths

[samzong]

Summary

Fixes #18.

• Reject unsafe source path values in specs/sources.yaml for Swagger, OpenAPI 3, GraphQL, and proto backends.
• Add a sync-layer safeJoin guard before copying configured files or passing proto paths to protoc.
• Cover all configured source path fields with focused validation tests.

Verification

• make check
• /pre-ship --committed manual gate: no MUST-FIX findings; sentinel written

Compatibility

Invalid source configs with absolute paths, parent traversal, or empty path segments now fail during load or sync. No generated command shape, catalog schema, auth, body, output, or generated code changes.

Checklist

• Tests or focused verification cover the changed surface.
• User-facing behavior changes are described in this PR; no generated workflow docs needed.
• Generated output under internal/generated/, .cache/, and ad-hoc skills/<cli-name>/ directories is not committed.
• Commits are signed off when this is ready to merge.