fix: stops a project-root storage path deleting project files

[Soviann]

What

Release-0.4.0 pre-flight found make mutation failing the 90% MSI floor (89.78%) — and, far worse, deleting composer.json from the real checkout, twice.

The data-loss guard (the headline)

composer.json / package.json match RECORD_NAME_PATTERN (<identifier>.json), so a storage.filesystem.path misconfigured to the project root lets deploytasks:reset/rollup list them as stale records and delete them. This is exactly what happened locally: a killed ConcatOperandRemoval mutant on the default path ('%kernel.project_dir%/var/deploy-tasks' → '%kernel.project_dir%') pointed storage at the checkout root, and the test teardown's reset() ate composer.json before the mutant died.

FilesystemStorage::assertDedicatedStorageDir() now refuses (with an actionable StorageException) any storage directory containing a composer.json — on both the listing path (records() → all/reset/removeAll) and the targeted path (filePath() → has/get/save/remove). TDD'd (both tests red first). CHANGELOG → Security; docs/storage.md documents the dedicated-directory requirement.

MSI back over the floor

8 escaped mutants killed in DeployTasksInstallHostCommand (from #32's new code):

• exact-relative-label assertions (no leading slash / no absolute remnant) kill the substr() off-by-one and unwrap mutants in gitkeepLabel();
• a {projectDir}-adjacent sibling-prefix test pins the trailing-slash boundary in str_starts_with();
• a 0o755 permission pin kills the mkdir mode mutants.

Test-pollution fix

RelativePathConfigTest now cleans its /tmp-side scratch dirs in setUp: a killed path-anchoring mutant writes /tmp/var/rel-deploy-state against the CWD before dying, which failed the next honest run's assertFileDoesNotExist (bit us twice today).

Verification

Full local make mutation after the change: Covered MSI 90%+, exit 0, and composer.json intact (previous two runs deleted it). Suite at 1120 tests, CS Fixer + PHPStan clean.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!