safety

The work-root guard I run before letting an agent near several repositories

When several repositories share one machine, an agent's working root is remarkably easy to mix up. Here is a small guard that compares resolved paths, tested against seven inputs.