version-location.json manifest_path is not contained, so payload stamp can write outside dest

[jogrun]

What

Launch include patterns reject .. and absolute paths (internal/core/launch/includes.go:108-119). manifest_path from .abcd/config/version-location.json does not.

validateVersionLocation (internal/core/launch/lockstep.go:122-138) only requires a non-empty string. editManifest (internal/core/launch/render.go:354-367) then:

path := filepath.Join(dest, filepath.FromSlash(rel))

and WriteFileAtomics the stamped JSON. "manifest_path": "../outside.json" walks out of --payload-dir. An absolute manifest_path makes Join drop dest entirely.

fsutil.ValidRelPath (internal/fsutil/paths.go:21) is the lexical guard the rest of the tree uses for a path that arrives as committed data.

Reproduction

Point version-location.json at "manifest_path": "../outside.json" with a valid json_pointer, run abcd launch ship (or RenderPayload) with --payload-dir a temp dest. The stamp lands next to dest, not inside it.

Suggested fix

Refuse manifest_path unless fsutil.ValidRelPath holds. Keep the blocked:true path unchanged. Test ../ and an absolute path. Watch both fail on main.

Happy to send a PR once this is accepted.