security: path validation, ReDoS prevention, picomatch, PID-based file lock

- Add validateProjectPath() to reject sensitive system directories
- Add isPathWithinRoot/isPathWithinRootReal for symlink-aware path checks
- Replace hand-rolled glob-to-regex with picomatch to prevent ReDoS
- Add isSafeRegex() to reject custom patterns with nested quantifiers
- Replace FileLock with PID-tracking version that detects stale locks
- Add symlink detection in removeDirectory/listDirectoryContents
- Add subdirectory name validation in ensureSubdirectory
- Add atomicWriteFileSync and corrupted file backup in config-writer
- Add MCP input validation (validateString) for all tool handlers
- Fix CLAUDE.md section replacement to handle ### subsections correctly

package.json

@@ -37,12 +37,14 @@
     "better-sqlite3": "^11.0.0",
     "commander": "^14.0.2",
     "figlet": "^1.8.0",
+    "picomatch": "^4.0.3",
     "tree-sitter": "0.22.4"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
     "@types/figlet": "^1.5.8",
     "@types/node": "^20.19.30",
+    "@types/picomatch": "^4.0.2",
     "typescript": "^5.0.0",
     "vitest": "^2.1.9"
   },