fix(security): validate paths and agent names to prevent traversal/injection (#3139)

Fixes #3136 - add path validation to uploadFile/downloadFile in local.ts
Fixes #3135 - add agentName validation before Docker shell commands

- validateLocalPath() resolves paths and rejects ".." traversal attempts
- validateAgentName() ensures agent names match [a-z0-9-]+ before Docker ops
- Both functions are exported for testability

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrouter/spawn",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "type": "module",
   "bin": {
     "spawn": "cli.js"