Hardening audit

Key hardening changes:

  - Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
    resolve to the repository root.
  - apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
    writing under a root-level module/.
  - Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
    --endpoint=, --output=.
  - build-changelog now supports --flag=value inline syntax like the other utilities.

internal/pipeline/apply_manifest.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"gitea.westgate.pw/ShadowsOverWestgate/sow-tools/internal/gff"
 	"gitea.westgate.pw/ShadowsOverWestgate/sow-tools/internal/project"
@@ -20,6 +21,13 @@ func ApplyHAKManifest(p *project.Project, manifestPath string) (ApplyManifestRes
 	if manifestPath == "" {
 		manifestPath = p.HAKManifestPath()
 	}
+	if strings.TrimSpace(p.EffectiveConfig().Paths.Source) == "" {
+		return ApplyManifestResult{}, fmt.Errorf("cannot apply hak manifest: paths.source is not configured")
+	}
+	sourceRoot := filepath.Clean(p.SourceDir())
+	if sourceRoot == "." || sourceRoot == string(filepath.Separator) || sourceRoot == filepath.Clean(p.Root) {
+		return ApplyManifestResult{}, fmt.Errorf("cannot apply hak manifest: paths.source resolves to unsafe source root %s", sourceRoot)
+	}
 
 	raw, err := os.ReadFile(manifestPath)
 	if err != nil {
@@ -31,7 +39,7 @@ func ApplyHAKManifest(p *project.Project, manifestPath string) (ApplyManifestRes
 		return ApplyManifestResult{}, fmt.Errorf("parse hak manifest: %w", err)
 	}
 
-	moduleSource := filepath.Join(p.SourceDir(), "module", "module.ifo.json")
+	moduleSource := filepath.Join(sourceRoot, "module", "module.ifo.json")
 	sourceRaw, err := os.ReadFile(moduleSource)
 	if err != nil {
 		return ApplyManifestResult{}, fmt.Errorf("read module ifo source: %w", err)