project-operations

No evidence of malware or data exfiltration. The archive CLI has a path traversal risk: unvalidated project or change-slug arguments can direct directory creation and moves outside their intended locations. This requires a user to invoke the archive command with crafted arguments, but should be fixed by validating names and resolving paths to ensure they remain within the intended roots.