security: validate CLI paths/args in dev tools (SonarCloud S2083/S8707/S8705/S7044)

Resolve and validate command-line path arguments before use, enforce HTTPS at
download sinks, and confirm path containment. Hardens local codegen/fetch tools
against path-traversal and command-argument-injection findings.

docs/showcase/run.py

@@ -1,6 +1,16 @@
 #!/usr/bin/env python3
 """lcb.py FILE.jsonl — run control requests from a JSON-lines file ({"method":..., "params":...} or {"sleep": s})."""
 import json, socket, sys, time
+from pathlib import Path
+
+
+def _jsonl_path(arg):
+    """Resolve the CLI file argument; require an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
 def call(method, params):
     s = socket.create_connection(("127.0.0.1", 7980), timeout=180)
     s.sendall((json.dumps({"id": 1, "method": method, "params": params}) + "\n").encode())
@@ -10,7 +20,7 @@ def call(method, params):
         if not c: break
         buf += c
     return json.loads(buf)
-for line in open(sys.argv[1]):
+for line in open(_jsonl_path(sys.argv[1])):
     line = line.strip()
     if not line or line.startswith("#"): continue
     r = json.loads(line)