security: harden data-derived paths + fix unchecked writable Close()

[ErenAri]

Cleans up the open CodeQL code-scanning alerts on the runtime/registry packages. Splits cleanly into real fixes and documented false positives.

Real hardening — path-injection on data-derived components

• New internal/safepath.LocalJoin: a filepath.IsLocal-based choke point (a CodeQL-recognized traversal barrier) that rejects any component escaping its base directory. Unit-tested for local names, .. escapes, and absolute paths.
• Applied at the three sinks whose filename is derived from data, not a human operator:
  • runtime/fetch.go — artifact target name built from registry record fields
  • artifact/artifact.go — staged basename from the source path
  • runtime/audit.go — decision-trace filename from caller-supplied DecisionID (reachable from the network-facing API), the highest-value one

Real hygiene — go/unhandled-writable-file-close (5) + go/useless-assignment (1)

• Surface Close() errors on append-mode writers instead of defer-and-drop, so a failed buffer flush isn't silently lost: agent/load_ledger.go, cloudregistry/store.go, registry/history.go, registry/local.go, runtime/audit.go.
• Drop a dead cmd = newCmd assignment in vm/qemu.go (only qemuProc is read afterward).

Intentionally not changed (false positives, to be dismissed with reason)

• Operator-controlled CLI/config paths: artifact.Inspect, compare.LoadReport, the fetch/audit rotation paths under the configured workdir, and the trusted-signing-key paths in registry/history.go. These name files the operator already owns; forcing containment would break legitimate absolute-path usage.
• api/report_paths.go:68 — already guarded by validatePathUnderRoots (EvalSymlinks + double containment check); CodeQL just doesn't recognize the custom barrier.

All of these are in internal/ (the frozen runtime agent + VM runner). None touch pkg/bpfcompat (library mode) or the in-guest validator.

Verification

• go build ./..., go vet ./..., go test ./... all green.
• New internal/safepath tests pass.

🤖 Generated with Claude Code