fix: contain run storage and cleanup authority

[danielgwilson]

Summary

• Bind managed run, Observer, feedback, lab, actor-output, Git-metadata, and source-archive paths to validated physical filesystem identities.
• Reject traversal-shaped identifiers, unsafe links and special files, root retargeting, and callback-driven output escapes.
• Carry the custom public-surface denylist into the tag-time publish gate and bump the package to 0.15.1.

Intentional fail-closed changes

• humanish cleanup no longer loads or mutates a provider from IDs stored in run.json. It writes an inspection receipt: resources already recorded as killed are already_clean; live or unknown records fail until a verified resource-lease contract exists. Same-process teardown continues to use the provider handles that created the resources.
• Live OSS meta-lab execution returns HUMANISH_OSS_META_LIVE_ISOLATION_REQUIRED before callbacks, filesystem or network side effects, credential forwarding, or provider launch. The dry-run contract and separate oss-smoke lane remain available.

Compatibility

0.15.1 is a corrective patch. Compared with 0.15.0, the package root keeps the same 127 runtime exports and function arities; no supported TypeScript declaration is removed or narrowed.

Valid managed runs and symlink cwd aliases remain supported. Computer-use results now report the pinned physical cwd. Ordinary repositories and verified linked worktrees remain supported; uncontained Git metadata, including arbitrary gitdir: redirects, is reported as unavailable instead of followed.

Verification

• pnpm release:check: 1,037 passed, 10 skipped; public scan, skill check, build, and npm dry-pack passed.
• Clean humanish@0.15.1 tarball install: zero reported vulnerabilities.
• CLI smoke: version, init, Doctor, dry-run, verify, lab list, detached Observer, and attached loopback Observer passed.
• Focused filesystem and callback regression coverage confirms rejected invalid states leave outside sentinels unchanged.