Development record

launch installsurface.go dirTree.resolve carries a bespoke partial path guard (rejects absolute and a leading ../ but not an embedded a/../../b) instead of the canonical fsutil.ValidRelPath. Read-only payload smoke so lower severity, but it should use the one canonical containment. Flagged by the #488 fix agent.