pinmux --family can escape the reported SDK root and read a table from another checkout

[alpCaner]

Found while reviewing

PR #352, feat/v06-batch at 1cab240df85d5896c5390697c069720ff2bb24d3.

The Python pinmux port accepts an arbitrary --family string and constructs:

table_path = Path(sdk[0]) / "metadata" / "pinmux" / f"{resolved_family}.yaml"

An absolute family discards the SDK prefix under normal pathlib semantics; .. components can escape it as well. No containment or stem validation is performed.

Reproduction

With two different alp-sdk checkouts:

tan pinmux \
  --sdk-root /home/caner/src/alp-sdk \
  --family /home/caner/alp-sdk/metadata/pinmux/aen \
  --format json

Observed:

rc=0
sdkRoot=/home/caner/src/alp-sdk
family=/home/caner/alp-sdk/metadata/pinmux/aen
pads=96
issues=[]

The envelope claims the first SDK root while the table came from the second checkout. A schema-shaped YAML outside either checkout can be read and surfaced the same way.

Impact

• sdkRoot no longer identifies the metadata source used for the result.
• IDE/extension consumers can receive data from outside the selected SDK checkout.
• Absolute and traversal-shaped family values cross a boundary the command's contract says is metadata/pinmux/<family>.yaml under the resolved SDK.

Acceptance criteria

• --family accepts only a safe family stem, not separators, absolute paths, . or .. components.
• The resolved table path is verified to remain under <sdkRoot>/metadata/pinmux before reading.
• Tests cover POSIX absolute paths, Windows drive/UNC paths, and ../ traversal.
• On rejection, emit one coded validation issue without reading the target.

Related: #257, #260, PR #352.

[alpCaner]

Fixed on dev in ac79d4c (PR #352). dev IS this repo's default branch, so Closes does fire here -- but this issue was filed AFTER the PR body's closing-keyword list was written, so it was never in it. Closed by hand; a merged PR body cannot close retroactively.

Two independent checks, since either alone has a hole: the stem is validated (no separator of either kind, no drive-relative or rooted-drive path, no UNC, no ./..), and the resolved path is re-verified to sit under <sdkRoot>/metadata/pinmux -- the stem check cannot see a symlink inside the SDK. The raw string is checked for BOTH separators regardless of host, since pathlib on POSIX does not treat a backslash as one.