fix(security): 2 improvements across 2 files

[tomaioo]

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: High | File: scripts/services/restore-removed-services.js:L26

When restoring removed services, the output file path is built using removedObject.id directly. Because serviceSchema only enforces id as a string (no path-safe pattern), an id like ../../.github/workflows/pwn could cause writes outside sourceDirPath during build execution.

Solution

Validate removedObject.id against a strict allowlist regex (e.g. ^[a-z0-9_-]+$), build paths with path.resolve(sourceDirPath, ...), and enforce that the resolved path starts with the resolved sourceDirPath before writing.

Changes

• scripts/services/restore-removed-services.js (modified)
• scripts/services/merge-services-data.js (modified)