Hardening audit

Key hardening changes:

  - Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
    resolve to the repository root.
  - apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
    writing under a root-level module/.
  - Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
    --endpoint=, --output=.
  - build-changelog now supports --flag=value inline syntax like the other utilities.

internal/project/project_test.go

@@ -648,6 +648,30 @@ func TestValidateLayoutRejectsUnsafeGeneratedOutputPaths(t *testing.T) {
 	}
 }
 
+func TestValidateLayoutRejectsRootSourceAndAssetPaths(t *testing.T) {
+	root := t.TempDir()
+	mkdirAll(t, filepath.Join(root, "build"))
+
+	proj := &Project{
+		Root: root,
+		Config: Config{
+			Module: ModuleConfig{Name: "Test", ResRef: "test"},
+			Paths:  PathConfig{Source: ".", Assets: ".", Build: "build"},
+		},
+	}
+
+	err := proj.ValidateLayout()
+	if err == nil {
+		t.Fatal("expected root source and asset path validation error")
+	}
+	if !strings.Contains(err.Error(), "paths.source") {
+		t.Fatalf("expected source path validation error, got %v", err)
+	}
+	if !strings.Contains(err.Error(), "paths.assets") {
+		t.Fatalf("expected assets path validation error, got %v", err)
+	}
+}
+
 func TestValidateLayoutRejectsInvalidAutogenConsumerConfig(t *testing.T) {
 	root := t.TempDir()
 	mkdirAll(t, filepath.Join(root, "src"))