fix(pkg-docker): reject unsafe build paths

[aiirvizionz]

Summary

• validate pkg-docker Dockerfile and context paths before writing build plans
• reject absolute paths, parent traversal, backslashes, empty segments, and null bytes
• keep existing relative Dockerfile/context planning behavior intact

Verification

• vitest run packages/targets/pkg-docker/src/index.test.ts (7 passed)
• tsc -p packages/targets/pkg-docker/tsconfig.json --noEmit
• git diff --check

Note: running through pnpm in this workspace currently triggers an unrelated lockfile policy failure for @profullstack/autoblog@0.4.0 missing tarball integrity, so I ran the local Vitest and TypeScript binaries directly.

[Copilot]

Pull request overview

This PR hardens the pkg-docker target by validating Docker build context and Dockerfile paths before generating and writing the build plan, preventing unsafe path inputs from being embedded into the planned docker buildx commands.

Changes:

• Added safeRelativePath() to validate context and dockerfile inputs (rejecting absolute paths, traversal, backslashes, empty segments, and null bytes).
• Routed build argument planning and the emitted plan JSON through the new path validation.
• Added a Vitest case covering several unsafe path examples.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
packages/targets/pkg-docker/src/index.ts	Introduces path validation and applies it to build arg generation and plan output.
packages/targets/pkg-docker/src/index.test.ts	Adds tests asserting unsafe dockerfile/context values are rejected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.

[github-actions]

🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.

[github-actions]

🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.