fix: address Cubic round-5 P1/P2 issues

- P1: add path traversal guard to getMessageDir (reject .., /, \)
- P2: treat unknown part types as non-content in messageHasContentFromSDK

src/shared/opencode-message-dir.ts

@@ -6,6 +6,7 @@ import { log } from "./logger"
 
 export function getMessageDir(sessionID: string): string | null {
   if (!sessionID.startsWith("ses_")) return null
+  if (/[/\\]|\.\./.test(sessionID)) return null
   if (isSqliteBackend()) return null
   if (!existsSync(MESSAGE_STORAGE)) return null