e3a427252d
Validates workstream name at all entry points — CLI --ws flag, GSD_WORKSTREAM env var, active-workstream file, and cmdWorkstreamSet — blocking names that don't match [a-zA-Z0-9_-]+. Also fixes getActiveWorkstream to use planningRoot() consistently and validates names read from the active-workstream file before using them in path joins. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>