fix(security): contain slop history writes

[alxxjohn]

Motivation

• Prevent untrusted repository configuration or in-repo symlinks from causing slop-history writes outside the repository by deriving and validating the history path separately.
• Prevent patch/validate (DiffText) flows from persisting state to repository-configured cache locations during transient validation runs.

Description

• Stop slop-history persistence when the scan context has non-empty DiffText by returning early from recordSlopHistory; change in internal/codeguard/checks/quality/quality_ai_history.go touches the imports and adds the DiffText guard using strings.TrimSpace(env.DiffText).
• Independently validate the derived slop-history path computed via cachefile.DerivedPath and reject configurations that would resolve the derived .slop-history outside the config directory, implemented in internal/codeguard/config/io.go alongside the existing legibility-history check.
• Route history file writes through the existing cachefile helpers (no change to cachefile.Write behavior); new path containment check prevents symlink-based escapes.
• Add regression tests: a patch-mode test that asserts no slop-history file is created (tests/checks/quality_ai_history_test.go) and a containment test that asserts a derived cache.slop-history.json symlink is rejected (tests/security/config_containment_paths_test.go).

Testing

• Ran go test ./tests/security ./tests/checks and the suites passed (ok reported for both packages).
• Ran the targeted unit test go test ./tests/checks -run TestSlopScoreHistoryDoesNotWriteDuringPatchValidation -count=1 which passed.
• Ran go test ./... to exercise the full test suite in this environment and observed success for the modified packages.

---

Codex Task