## What changed
- Require selected skill paths to resolve within the cloned repository and reject
symlinked path components.
- Reject special files and symlinks that escape the selected skill or resolve to
anything other than a regular file.
- Add regression tests showing that escaping symlinks are rejected while links
to regular files within the skill are installed as file contents.
GitOrigin-RevId: d4c3f09fb630dea96b34ea5552de571b36f1ceca
