fix: UNSAFE_TOOL_OUTPUT_PATH false positive on prefix boundaries

[dmchaledev]

Summary

The UNSAFE_TOOL_OUTPUT_PATH rule used String.startsWith() to check whether a tool's output path falls under a system directory (/etc, /proc, /sys, /boot, /root, /dev). This caused false positives for legitimate paths that merely start with the same characters as a system directory:

Path	Before (wrong)	After (correct)
/etcfoo/bar	❌ Fired	✅ Safe
/procrastinate/file	❌ Fired	✅ Safe
/device/some-path	❌ Fired	✅ Safe
/rootfs/data	❌ Fired	✅ Safe
/etc/passwd	✅ Fired	✅ Fired
/proc/1/mem	✅ Fired	✅ Fired
/etc (exact)	✅ Fired	✅ Fired

Fix

Replace bare startsWith(dir) with a proper path-boundary check:

const isUnsafe = UNSAFE_OUTPUT_DIRS.some((dir) => {
  const p = tool.outputPath!;
  return p === dir || p.startsWith(dir + '/');
});

This ensures only exact matches or proper subdirectories trigger the rule.

Tests Added

5 new test cases in src/__tests__/scanner.test.ts:

• /etcfoo — prefix boundary guard (should NOT fire)
• /procrastinate — prefix boundary guard (should NOT fire)
• /device — prefix boundary guard (should NOT fire)
• /rootfs — prefix boundary guard (should NOT fire)
• /etc exact match (should fire)

Verification

• ✅ npx tsc --noEmit — type checking passes
• ✅ npm test — 75/75 tests pass (was 70)
• ✅ npm run lint — 0 warnings