feat(core): implement security sandbox for template execution

[JacksonFergusonDev]

Overview

As Protostar transitions to allowing remote template execution (protostar init --from <url>), it is critical to ensure that external templates cannot write files outside the project directory or invoke arbitrary shells. This PR implements a comprehensive security sandbox within the SystemExecutor.

Changes

• Zip Slip Protection: Added safe_extract_zip to fs.py to prevent path traversal when extracting .zip archives.
• Path Jail Guardrail: Introduced _enforce_path_jail to ensure all file injections and scaffolding directives are strictly confined to the workspace.
• Binary Safelist Guardrail: Introduced _enforce_binary_safelist to prevent execution of arbitrary shells and limit system tasks to a curated whitelist of safe binaries (uv, git, npm, yarn, pnpm, pre-commit, direnv).
• Domain Errors: Added SecurityViolationError for explicit vulnerability handling.
• Comprehensive Test Suite: Added 100% test coverage for bypass scenarios including directory traversal, symlink spoofing, and binary evasion.