fix: constrain code generation writes to workdir

[cloudcarver]

Summary

• centralize workdir-confined path resolution for generator mutations
• constrain schema, OAPI, task, DST, mock, wire, SQLC, anclaxdef, and clean outputs
• use rooted filesystem operations and symlink containment checks
• preserve external read-only input compatibility and trusted SQLC plugins
• add absolute, traversal, symlink, SQLC sink, and cleanup rollback tests

Validation

• go test -count=1 ./...
• go test -race ./cmd/anclax ./pkg/codegen/codegenpath ./pkg/codegen/oapi ./pkg/codegen/schemas ./pkg/codegen/task
• go vet ./...
• git diff --check

Closes #36