fix: harden official sync filesystem boundaries

Fixes #14

infrastructure/src/lib.rs

@@ -18,6 +18,7 @@ pub mod official_launcher;
 pub mod official_pull;
 pub mod official_sync;
 pub mod official_update;
+pub mod path_security;
 pub mod resources;
 mod zip_validation;
 
@@ -52,6 +53,11 @@ pub use official_update::{
     OfficialUpdateConfig, OfficialUpdateProgress, OfficialUpdateReport, OfficialUpdateService,
     OfficialUpdateSnapshot, OfficialUpdateStatus, OfficialVerificationSummary, ResolvedBootstrap,
 };
+pub use path_security::{
+    ensure_path_within_root, ensure_safe_directory_path, ensure_safe_file_target, lexical_absolute,
+    open_append_file, read_file_no_symlink, set_file_mode, validate_output_root,
+    validate_runtime_state_dir, write_file_atomic, PRIVATE_FILE_MODE, STATE_FILE_MODE,
+};
 pub use resources::{InMemoryResourceRepository, SqliteResourceRepository};
 
 /// Infrastructure 版本号