fix(storage): reject path-traversal artifact ids from untrusted slug_hint

[kai392]

Summary

• Root cause: KBStore._yaml / _page_path / _source_dir joined attacker-controlled artifact ids straight into filenames. propose_* takes slug_hint verbatim as the id, and Claim/Page/Entity/Relation models do not constrain id the way Source.id is hex-locked. Approving slug_hint="../../../../evil" (or a Windows absolute path) wrote an artifact outside .vouch/, defeating the review gate.
• Fix: Add _validate_artifact_id at the single path-builder chokepoint (same class of guard as bundle._unsafe_name_reason / read_under_root). Reject empty ids, path separators, NUL, absolute prefixes, ./.., and .. path segments before any file is created. Covers MCP, JSONL, CLI, and direct KBStore callers.
• Impact: Untrusted proposers can no longer turn an approval into an arbitrary filesystem write. Legitimate slug/sha/ev- ids are unaffected.

Prior attempts (#171, #301, #138, #150, #187) were closed as stale or overscoped; the bug is still present on test. This PR is the minimal storage-only fix with regression tests.

Test plan

• test_put_rejects_path_traversal_ids — parametrized over ../, separators, absolute, ./.., NUL, empty
• test_validate_artifact_id_rejects_non_string
• test_approve_with_traversal_slug_hint_writes_nothing — end-to-end propose+approve must not create the escaped target
• Full tests/test_storage.py green locally
• CI lint / mypy / pytest matrix / diff-coverage 100% green

Risk / tradeoffs

• Proposals already filed with a malicious slug_hint will fail at approve with ValueError instead of writing outside the KB (correct failure mode).
• No CHANGELOG-only conflict surface beyond a single Unreleased Fixed bullet; no unrelated reformatting.

[kai392]

@coderabbitai review