fix(cli): reject normalized agent directory names

src/secure-files.ts

@@ -26,6 +26,7 @@ export function resolvePrivateChildDirectory(root: string, childName: string): s
     || childName.includes('\\')
     || childName === '.'
     || childName === '..'
+    || childName.startsWith(' ')
     || childName.endsWith('.')
     || childName.endsWith(' ')
     || isWindowsDeviceName

test/cli-security.test.mjs

@@ -109,6 +109,7 @@ test('CLI rejects agent IDs that escape the credential directory', async () => {
     'C:escape',
     'agent.',
     'agent ',
+    ' agent',
     'CON',
     'COM¹.log',
     '.',