cd19eaae38
- migration.md: path-safety checks now raise ResourceSecurityError rather than silently falling through; null bytes are rejected by default; templates may have at most one multi-segment variable - resources.md: add reject_null_bytes to the settings table; note that ResourceSecurity is a heuristic and safe_join remains the containment boundary