fix(cli): confine agent runtime paths

AGENTS.md

@@ -38,6 +38,7 @@ This repository owns the published `@elydora/sdk` package, its `elydora` CLI, lo
 - Avoid compatibility shims without a named public or user configuration contract.
 - Keep private keys and API tokens out of process arguments and generated setup commands. Accept them through hidden terminal input or owner-only credential files.
 - Persist credential-bearing files through owner-only same-directory temporary files and atomic rename.
+- Resolve every agent runtime directory as one physical child of `~/.elydora`; reject separators, traversal segments, and symbolic-link directories before writes.
 
 ## Verification