Address automated review findings on PR #2482:
- source.mjs: validate URL-derived subdir with safePathInsideRoot so a
../ subdir can't copy out of the shared clone cache; run cleanup() if
the terminal copyDir throws so the temp working dir never leaks.
- install.mjs: reject unknown --channel values (e.g. a 'stabl' typo)
instead of silently treating them as the 'next' default.
- remove.mjs / update.mjs: containment-check manifest/CLI-derived paths
before destructive fs.rm / atomic swap, reusing safePathInsideRoot.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
02806ba4cd