Enforce install-dir containment on uninstall; resolve manifest verification key

[TeoSlayer]

Two audit findings in skillinject.

L27 (high) — uninstall omitted the containment guard the install path enforces

reconcilePluginFiles rejects any plugin.files[].name whose joined path resolves outside the plugin install directory. Uninstall did not: it joined the same manifest-supplied name and handed the result straight to removeOwnedFile, so a name like ../../../.ssh/authorized_keys deleted a file the install path had never written.

Both sides now share a pathWithin(dir, path) helper in manifest.go. Out-of-scope names are reported as a RemovalError and skipped. In-scope removals are unchanged.

L28 (high) — manifest verification was opt-in and nil-by-default

Config.ManifestPublicKey had to be supplied by the caller; nil silently skipped Ed25519 detached-signature verification, leaving TLS as the only check on the fetched manifest and repo files.

The key is now resolved in precedence order:

1. Config.ManifestPublicKey
2. PILOT_SKILLINJECT_PUBKEY (hex or base64)
3. ~/.pilot/skillinject.pub
4. compiled-in DefaultManifestPublicKeyHex

Config.RequireSignedManifest / PILOT_SKILLINJECT_REQUIRE_SIG turns a resolved key from optional into mandatory.

Both new controls default off: with no key configured anywhere, fetch behaviour is byte-identical to before, so nothing breaks for existing installs. Operators can now enable verification without a code change, and populating DefaultManifestPublicKeyHex (currently "") flips it on by default once a signing key is published.

Not addressed here: the "move to org repo" half of L28. DefaultManifestURL / DefaultRepoBaseURL still point at TeoSlayer/pilot-skills because that repo has not been transferred yet (its origin is still TeoSlayer/pilot-skills); repointing now would break every install. The existing TODO comments in manifest.go still track it.

Tests

• zz_uninstall_traversal_test.go — an escaping name leaves a seeded file outside the install dir byte-identical and surfaces a RemovalError; an in-dir file is still deleted; the install side does not write outside either.
• zz_manifest_key_test.go — pathWithin table, key decoding (hex / base64 / raw base64 / bad input), full resolution precedence, require-flag parsing, and getOrVerify in all three modes (no key → unverified and no .sig fetched; require-without-key → error; resolved key → verifies and rejects a tampered body).

go build ./..., go vet ./..., go test ./... green. gofmt -l flags service.go and zz_skillinject_test.go, both pre-existing and untouched.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!