Hardening audit

Key hardening changes:

  - Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
    resolve to the repository root.
  - apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
    writing under a root-level module/.
  - Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
    --endpoint=, --output=.
  - build-changelog now supports --flag=value inline syntax like the other utilities.

tools/README.md

@@ -1 +1,9 @@
-Place the built `sow-toolkit` binary here for sibling repositories to consume during development or for release packaging.
+Built development binaries live here:
+
+- `sow-toolkit` on Linux/macOS
+- `sow-toolkit.exe` on Windows
+
+Use `../sow-tools/build-tool.sh` or `../sow-tools/build-tool.ps1` from this
+repository root to refresh the binary. Sibling consumer repositories may point
+their wrappers at this directory during local development; release workflows can
+copy a pinned binary into each consumer repo's own `tools/` directory.