fix: guard project IDs before path joins

[seonghobae]

Summary

• Replace the dirty/conflicted 🛡️ Sentinel: [CRITICAL] 프로젝트 ID 입력의 경로 탐색(Path Traversal) 취약점 수정 #494 path traversal branch with a focused two-file fix.
• Centralize project ID validation before any base_root.join(project_id) path construction.
• Reject empty IDs, . / .. path components, /, and \, while preserving benign identifiers such as my..id.
• Add Rust unit coverage for parent-component, forward-slash, backslash, and benign interior-dot cases.
• Record the corrected Sentinel security note without claiming IPC projectId directly reaches app_owned_root.

Verification

• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml --check
• npm ci (local Node v24.16.0 emits repo engine warning; install succeeds)
• npm --workspace apps/desktop run build
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml project_id -- --nocapture
• python3 scripts/checks/verify_security_notes.py
• python3 scripts/checks/verify_supply_chain.py
• python3 scripts/checks/security_gates.py
• git diff --check

Supersedes the security intent of #494, whose branch currently contains broad unrelated workflow/design/package churn and remains merge-dirty.