Section 2 — Shared path safety (Tasks 6–7)

[aram356]

Part of #288 (epic). Umbrella PR: #287.

Plan reference

docs/superpowers/plans/2026-06-27-provision-local.md — Section 2.

Tasks

• Task 6: Create path_safety module with assert_provision_paths_contained (relative-root short-circuit; manifest-inside-crate check; 8 unit tests)
• Task 7: Wire path_safety into config push --local's args.local arm; mirror tests beside config fixtures

Dependencies

Independent of Section 1; can run in parallel.

Tests required

8 path_safety unit tests + 2 push-side mirror tests. See plan Task 6 step 1 and Task 7 step 1.

CI

All five gates must pass.