feat(sdk): Phase 1 typed query foundation (gsd-sdk query) (#2118)

* feat(sdk): add typed query foundation and gsd-sdk query (Phase 1)

Add sdk/src/query registry and handlers with tests, GSDQueryError, CLI query wiring, and supporting type/tool-scoping hooks. Update CHANGELOG. Vitest 4 constructor mock fixes in milestone-runner tests.

Made-with: Cursor

* chore: gitignore .cursor for local-only Cursor assets

Made-with: Cursor

* fix(sdk): harden query layer for PR review (paths, locks, CLI, ReDoS)

- resolvePathUnderProject: realpath + relative containment for frontmatter and key_links

- commitToSubrepo: path checks + sanitizeCommitMessage

- statePlannedPhase: readModifyWriteStateMd (lock); MUTATION_COMMANDS + events

- key_links: regexForKeyLinkPattern length/ReDoS guard; phase dirs: reject .. and separators

- gsd-sdk: strip --pick before parseArgs; strict parser; QueryRegistry.commands()

- progress: static GSDError import; tests updated

Made-with: Cursor

* feat(sdk): query follow-up — tests, QUERY-HANDLERS, registry, locks, intel depth

Made-with: Cursor

* docs(sdk): use ASCII punctuation in QUERY-HANDLERS.md

Made-with: Cursor

sdk/src/query/helpers.test.ts

@@ -2,7 +2,11 @@
  * Unit tests for shared query helpers.
  */
 
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { GSDError } from '../errors.js';
 import {
   escapeRegex,
   normalizePhaseName,
@@ -13,6 +17,7 @@ import {
   stateExtractField,
   planningPaths,
   normalizeMd,
+  resolvePathUnderProject,
 } from './helpers.js';
 
 // ─── escapeRegex ────────────────────────────────────────────────────────────
@@ -223,3 +228,27 @@ describe('normalizeMd', () => {
     expect(result).toBe(input);
   });
 });
+
+// ─── resolvePathUnderProject ────────────────────────────────────────────────
+
+describe('resolvePathUnderProject', () => {
+  let tmpDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(join(tmpdir(), 'gsd-path-'));
+    await writeFile(join(tmpDir, 'safe.md'), 'x', 'utf-8');
+  });
+
+  afterEach(async () => {
+    await rm(tmpDir, { recursive: true, force: true });
+  });
+
+  it('resolves a relative file under the project root', async () => {
+    const p = await resolvePathUnderProject(tmpDir, 'safe.md');
+    expect(p.endsWith('safe.md')).toBe(true);
+  });
+
+  it('rejects paths that escape the project root', async () => {
+    await expect(resolvePathUnderProject(tmpDir, '../../etc/passwd')).rejects.toThrow(GSDError);
+  });
+});