ref(security): Add SafeDirectory to enforce path traversal checks

[runningcode]

Summary

Introduces SafeDirectory — a Path-like wrapper that validates untrusted input stays within bounds — and removes is_safe_path() entirely.

• ZipProvider.extract_to_temp_directory() returns SafeDirectory instead of Path
• SafeDirectory.resolve(untrusted) replaces all manual is_safe_path() + raise UnsafePathError patterns — developers can't accidentally skip the check
• SafeDirectory.child(untrusted) creates a scoped subdirectory (e.g. AAB's base/ dir)
• Trusted Path operations (glob, rglob, /, exists, relative_to, etc.) are delegated directly, so SafeDirectory is a drop-in wherever Path was used before
• Icon parsers (IconParser, BinaryXmlDrawableParser, ProtoXmlDrawableParser) now accept only SafeDirectory, enforcing the safety boundary at the type level
• UnsafePathError / UnreasonableZipError moved to exceptions.py; all imports updated to use the canonical location
• is_safe_path() removed — SafeDirectory.resolve() is the single path validation mechanism
• Added SafeDirectory guidance to CLAUDE.md for future development

Fixes EME-1158

[sentry]

📲 Install Builds

iOS

🔗 App Name	App ID	Version	Configuration
HackerNews	com.emergetools.hackernews	3.8 (1)	Release

Android

🔗 App Name	App ID	Version	Configuration
Hacker News	com.emergetools.hackernews	1.0.2 (13)	Release

⚙️ launchpad-test-android Build Distribution Settings

[runningcode]

moved from zipprovider to avoid circular imports.

[cameroncooke]

A malicious plist can put glob metacharacters in CFBundleIconFiles. resolve(icon_name) doesn't catch them because *, ?, [, **/ are all legal filename characters and the resolved path stays inside the base.

Examples:

• icon_name = "*" → glob("**.png") matches every PNG in the bundle root.
• icon_name = "/" → glob("/*.png") matches every PNG anywhere in the bundle (** activates as recursive when it's a path segment).

While not exploitable it's probably something we want to tighten up on.

[runningcode]

Is that something introduced/changed in this PR?

[cameroncooke]

No it's just something Claude pointed out as a vulnerability that we didn't close, though worse case is it just misdirects to another .png in same zip so not high risk, it can't leak out of the zip folder.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 05ab037. Configure here.}

[sentry]

Bug: The SafeDirectory.rglob method silently skips symlinks that resolve outside the base directory, causing consumers like code signature validation to fail incorrectly.
_{Severity: HIGH}

Suggested Fix

Modify SafeDirectory.rglob to yield symlinks even if their target is outside the base directory. The current implementation filters paths where path.resolve().is_relative_to(self._base) is true. This check should be removed or adjusted to allow consumers to handle symlinks as they see fit, restoring the previous behavior needed for correct code signature validation.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/launchpad/artifacts/providers/safe_directory.py#L68-L72

Potential issue: The `SafeDirectory.rglob` method filters out paths that are symlinks
resolving to a target outside of the base directory. This is a regression from the
previous `Path.rglob` behavior. A key consumer, the code signature validation in
`_check_bundle_resources`, relies on iterating over all resources listed in the
manifest, including valid symlinks pointing outside the app bundle. Because `rglob` now
silently skips these symlinks, they are never processed and are incorrectly reported as
"file missing", leading to false positive validation failures.

[linear-code]

EME-1158