[msmps]

validateProjectName accepted '/', absolute paths and 'foo/../..' because a
name with slashes that did not match the scoped-package pattern skipped the
URL-friendly check. Combined with the 'directory exists, delete it?' prompt,
one confirmation could recursively delete a folder outside the working
directory.

Reject such names (and '@scope/..'), and resolve the project path through
resolveProjectPath, which refuses anything that is not a new folder strictly
inside the current directory.

---

Stack

Merge bottom-up into main: merge #100 first, then each PR above it (GitHub retargets the next one to main).

• ci: publish releases from version tags with npm trusted publishing #107 ci: publish releases from version tags with npm trusted publishing
• chore: upgrade to TypeScript 7 with Effect diagnostics via @effect/tsgo #106 chore: upgrade to TypeScript 7 with Effect diagnostics via @effect/tsgo
• chore: tighten repository settings and add CI #105 chore: tighten repository settings and add CI
• refactor: address review concerns in the CLI package #104 refactor: address review concerns in the CLI package
• fix: report the real cause of failures instead of hiding it #103 fix: report the real cause of failures instead of hiding it
• 👉 fix: keep the project folder inside the current directory #102 fix: keep the project folder inside the current directory
• chore: migrate CLI to Effect v4 #101 chore: migrate CLI to Effect v4
• chore: migrate development tooling to Vite+ #100 chore: migrate development tooling to Vite+
• main