Fix path traversal vulnerability in init_from_code template file download

[Copilot]

f.Path from the GitHub API tree response was written directly via os.WriteFile with only a weak strings.Contains(entry.Path, "..") guard, which doesn't catch normalized traversal patterns like infra/./../../etc/passwd.

Changes

• Replace strings.Contains(entry.Path, "..") with filepath.Clean() normalization followed by strings.HasPrefix(cleanPath, "..") and filepath.IsAbs(cleanPath) checks — catches traversal attempts that survive raw string matching
• Store the cleaned path in templateFileInfo.Path so all downstream uses (os.Stat, download URL construction, os.MkdirAll, os.WriteFile) operate on the normalized value rather than the raw API response string

// Before
if strings.Contains(entry.Path, "..") || filepath.IsAbs(entry.Path) {
    return fmt.Errorf("invalid path in repository tree: %s", entry.Path)
}

// After
cleanPath := filepath.Clean(entry.Path)
if filepath.IsAbs(cleanPath) || strings.HasPrefix(cleanPath, "..") {
    return fmt.Errorf("invalid path in repository tree: %s", entry.Path)
}

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.