fix: resolve 25 pre-publish blockers

- postinstall.mjs: fix alias package detection
- migrate-legacy-plugin-entry: dedupe + regression tests
- task_system: default consistency across runtime paths
- task() contract: consistent tool behavior
- runtime model selection, tool cap, stale-task cancellation
- recovery sanitization, context-limit gating
- Ralph semantic DONE hardening, Atlas fallback persistence
- native-skill description/content, skill path traversal guard
- publish workflow: platform awaited via reusable workflow job
- release: version edits reapplied before commit/tag
- JSONC plugin migration: top-level plugin key safety
- cold-cache: user fallback models skip disconnected providers
- docs/version/release framing updates

Verified: bun test (4599 pass), tsc --noEmit clean, bun run build clean

src/shared/skill-path-resolver.ts

@@ -1,4 +1,4 @@
-import { join } from "path"
+import { isAbsolute, relative, resolve, sep } from "node:path"
 
 function looksLikeFilePath(path: string): boolean {
 	if (path.endsWith("/")) return true
@@ -6,22 +6,21 @@ function looksLikeFilePath(path: string): boolean {
 	return /\.[a-zA-Z0-9]+$/.test(lastSegment)
 }
 
-/**
- * Resolves @path references in skill content to absolute paths.
- *
- * Matches @references that contain at least one slash (e.g., @scripts/search.py, @data/)
- * to avoid false positives with decorators (@param), JSDoc tags (@ts-ignore), etc.
- * Also skips npm scoped packages (@scope/package) by requiring a file extension or trailing slash.
- *
- * Email addresses are excluded since they have alphanumeric characters before @.
- */
 export function resolveSkillPathReferences(content: string, basePath: string): string {
 	const normalizedBase = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath
 	return content.replace(
 		/(?<![a-zA-Z0-9])@([a-zA-Z0-9_-]+\/[a-zA-Z0-9_.\-\/]*)/g,
 		(match, relativePath: string) => {
 			if (!looksLikeFilePath(relativePath)) return match
-			return join(normalizedBase, relativePath)
+			const resolvedPath = resolve(normalizedBase, relativePath)
+			const relativePathFromBase = relative(normalizedBase, resolvedPath)
+			if (relativePathFromBase.startsWith("..") || isAbsolute(relativePathFromBase)) {
+				return match
+			}
+			if (relativePath.endsWith("/") && !resolvedPath.endsWith(sep)) {
+				return `${resolvedPath}/`
+			}
+			return resolvedPath
 		}
 	)
 }