feat: secure project name and destination validation

[dDevAhmed]

Summary

Implements CLI-024 by adding the first filesystem/path security boundary for stellarforge new.

Included

• validates project names before destination planning
• rejects . / .., POSIX and Windows-style traversal/path input, absolute/path-like names, hidden-leading-dot names, unsafe characters, and Windows reserved device names
• resolves the working directory before planning
• requires the project destination to remain inside the resolved working directory
• refuses destinations occupied by files
• refuses existing non-empty directories with an explicit no-overwrite MVP policy
• allows existing empty directories
• performs no filesystem writes during validation/planning
• integrates the secure validator/planner into the default new command services
• adds POSIX/Windows-relevant malicious-input and destination-conflict tests

Security

• no overwrite prompt or implicit force behavior
• no traversal outside the generation root
• no shell/process execution
• validation/planning are read-only
• errors are explicit and do not dump filesystem contents

Closes #27