[SECURITY] Path traversal in SkillManager slug validation

[Livezt]

Security Bug: Path Traversal

File: src/extension/skills/SkillManager.ts line 29

const SLUG_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/;

Issue: Only checks literal ".." — misses URL-encoded traversal.

Security Impact:

• File read outside skill directory
• CVSS ~6.1 (Medium)

Recommended Fix:

if (slug.includes('..')) return false;
const normalized = path.normalize(slug);
if (normalized.startsWith('..')) return false;