Hardening audit

Key hardening changes:

  - Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
    resolve to the repository root.
  - apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
    writing under a root-level module/.
  - Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
    --endpoint=, --output=.
  - build-changelog now supports --flag=value inline syntax like the other utilities.

internal/app/app_test.go

@@ -391,6 +391,43 @@ paths:
 	}
 }
 
+func TestInlineFlagParsersRejectEmptyValues(t *testing.T) {
+	if _, err := parseBuildHAKArgs([]string{"--hak="}); err == nil || !strings.Contains(err.Error(), "--hak requires a value") {
+		t.Fatalf("expected empty --hak inline value error, got %v", err)
+	}
+	if _, err := parseMusicCommandArgs([]string{"--dataset="}); err == nil || !strings.Contains(err.Error(), "--dataset requires a value") {
+		t.Fatalf("expected empty --dataset inline value error, got %v", err)
+	}
+	if _, err := parseDeployWikiArgs("deploy-wiki", []string{"--endpoint="}); err == nil || !strings.Contains(err.Error(), "--endpoint requires a value") {
+		t.Fatalf("expected empty --endpoint inline value error, got %v", err)
+	}
+	if _, err := parseBuildChangelogArgs("build-changelog", []string{"--output="}); err == nil || !strings.Contains(err.Error(), "--output requires a value") {
+		t.Fatalf("expected empty --output inline value error, got %v", err)
+	}
+}
+
+func TestParseBuildChangelogArgsAcceptsInlineValues(t *testing.T) {
+	opts, err := parseBuildChangelogArgs("build-changelog", []string{
+		"--config=scripts/changelog.json",
+		"--output=CHANGELOG.md",
+		"--current-tag=v2",
+		"--previous-tag=v1",
+		"--api-base-url=https://gitea.example/api/v1",
+		"--token=secret",
+	})
+	if err != nil {
+		t.Fatalf("parseBuildChangelogArgs failed: %v", err)
+	}
+	if opts.configPath != "scripts/changelog.json" ||
+		opts.outputPath != "CHANGELOG.md" ||
+		opts.currentTag != "v2" ||
+		opts.previousTag != "v1" ||
+		opts.apiBaseURL != "https://gitea.example/api/v1" ||
+		opts.token != "secret" {
+		t.Fatalf("unexpected changelog opts: %#v", opts)
+	}
+}
+
 func mkdirAll(t *testing.T, path string) {
 	t.Helper()
 	if err := os.MkdirAll(path, 0o755); err != nil {