hummingbird-theme-qa

The script is intended as a defensive directory selector, not malware. Its path-resolution logic can fail open for paths containing `..`: an apparent path outside a guarded directory may resolve inside one, allowing the directory and evidence file to be written there. Normalize and validate the final path before the guard comparison, and account for symlink changes.