8n0 validate DIST_DIR before --clean rm -rf

The --clean action ran `rm -rf "$DIST_DIR"` after only an `[ -d ]` check,
so a misconfigured DIST_DIR (empty, /, $HOME, system dirs, etc.) could
recursively delete the wrong tree.

Add validate_clean_dist_dir (and resolve_dist_dir_path) in
config.validate.source.sh and call it in the --clean case before any
deletion. The guard canonicalizes DIST_DIR with `pwd -P` (handling ./
trailing slashes, symlinks and relative paths; for a not-yet-existing
dir it resolves the existing parent and re-attaches the basename) and
refuses to clean when the resolved path is empty, the filesystem root, a
well-known system directory, the resolved $HOME, or the current working
directory. Rejection uses config_error with a clear message and a
non-zero exit, so nothing is deleted. Normal DIST_DIRs still clean.

Tests (tests/cli.sh, registered in main): a HOME-as-DIST_DIR case (uses
a fake HOME under TEST_TMPDIR with a sentinel file, so a regression can
only touch the throwaway temp dir) and an empty-DIST_DIR case both assert
rejection and that nothing is removed.

Note: leftover staging artifacts on --clean are out of scope (task ln0).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/src/lib/action.source.sh b/src/lib/action.source.sh
index 12be053..edececa 100644
--- a/src/lib/action.source.sh
+++ b/src/lib/action.source.sh
@@ -188,6 +188,16 @@ run_configured_action() {
 
     case "$SHURIKEN_CLI_ACTION" in
         --clean)
+            # Validate DIST_DIR before any destructive rm -rf. Unlike the bare
+            # check that used to live here, validate_clean_dist_dir rejects unset,
+            # empty, and dangerous paths (/, HOME, cwd, system dirs) so a
+            # misconfigured DIST_DIR can never nuke the wrong tree.
+            validate_clean_dist_dir
+            status=$?
+            if (( status != 0 )); then
+                return "$status"
+            fi
+
             if [ -d "$DIST_DIR" ]; then
                 log_info "Cleaning $DIST_DIR"
                 rm -rf "$DIST_DIR"