fix: validate branchOverride to prevent path traversal in worktree creation

Reject absolute paths and values that escape .ralphex/worktrees/ when
--branch override is used as a filesystem path element.

Author: bronislav

pkg/git/service.go

@@ -279,7 +279,14 @@ func (s *Service) CreateWorktreeForPlan(planFile, defaultBranch, branchOverride
 	if earlyBranch == "" {
 		earlyBranch = plan.ExtractBranchName(planFile)
 	}
-	wtPath := filepath.Join(s.repo.root(), ".ralphex", "worktrees", earlyBranch)
+	wtBase := filepath.Join(s.repo.root(), ".ralphex", "worktrees")
+	wtPath := filepath.Join(wtBase, earlyBranch)
+	if filepath.IsAbs(earlyBranch) {
+		return "", false, fmt.Errorf("invalid branch name %q: must not be an absolute path", earlyBranch)
+	}
+	if rel, err := filepath.Rel(wtBase, wtPath); err != nil || strings.HasPrefix(rel, "..") {
+		return "", false, fmt.Errorf("invalid branch name %q: must not escape worktrees directory", earlyBranch)
+	}
 
 	// prune stale worktree entries first
 	if pruneErr := s.repo.pruneWorktrees(); pruneErr != nil {