fix: profiles bugs found by Code Scanning #238

Summary

Code Scanning alerts #69, #72, #73 — bugs in src/engine/profiles.rs and src/config/schema.rs from PR #237.

Bugs

1. Alert 🔴 Security: TOML injection in save_api_key() #69 — Path::new(name) resolves relative to CWD, not .cora.yaml location. Running cora from a different directory loads wrong profile or fails silently.
2. Alert 🔒 Security: Auth file permission not validated on read #72 — resolve_profile failure is warn-only. Misspelled or malformed profile in CI silently disables review policy.
3. Alert 🔒 Security: Git diff arguments not separated with -- #73 — .extend() appends focus_areas without dedup by id. Extending a built-in with redefined area creates duplicate/conflicting prompt instructions.

Fix Plan

• Alert 🔴 Security: TOML injection in save_api_key() #69: resolve profile file paths relative to the config file being loaded
• Alert 🔒 Security: Auth file permission not validated on read #72: return error instead of warn, fail fast on invalid profile
• Alert 🔒 Security: Git diff arguments not separated with -- #73: merge focus_areas by id (replace existing, append new)