Factory skill linking acts only inside the Run's own worktree #670

This was generated by AI during triage.

Private record: https://github.com/JacobStephens2/thirdshift/security/advisories/GHSA-r5wj-xc34-hpvm

What to change

Before skills::link_into creates, removes or links anything, it checks that the Adapter's project skills directory (Adapter::project_skills()), and every directory between it and the worktree root, is an ordinary directory inside the Run's acquired worktree. It then creates and replaces each Factory skill link relative to that checked directory, without looking up the joined path a second time. If the check fails, it refuses with an error naming the directory and changes nothing.

Acceptance criteria

• When every directory on the project skills path is an ordinary directory inside the worktree, or doesn't exist yet, linking works as it does today for every Adapter.
• When any directory on that path is not an ordinary directory inside the worktree, link_into returns an error and creates, removes or replaces nothing, inside or outside the worktree.
• Replacing an existing Factory skill entry and creating its link both act on the checked directory, with no second lookup of the path.
• Sessions::within reports the refusal as a session start failure, and the Harness is never started.
• In-process tests use scratch worktrees to cover both outcomes for each Adapter's project skills path.

Out of scope

• The shared exclude-file update (skills::exclude).
• Harness trust (ADR 0013) and anything a session does after it starts.
• The checks made when a worktree is acquired.