fix(security): reject path traversal in build_script and validate default_jobs range

.omo/notepads/tofu-core/learnings.md

@@ -1418,3 +1418,22 @@ The sandbox test (test 2) creates a sentinel file, serves an index containing `o
 - **Escape in unit tests**: all 8 pre-existing info.d tests used recipes WITH a `deps`
   field, so the absent-deps path was never exercised. Regression tests must cover the
   *negative* field, not just happy paths.
+
+## F2 review — build_script path validation & default_jobs range check
+
+### Path-traversal guard pattern (fetch.d)
+- Any user-influenced path destined for `cacheDir ~ "/" ~ path` must be
+  validated: reject `..` substrings, leading `/` (absolute), and `\`
+  (Windows separators). Also verify the joined destination with
+  `startsWith(cacheDir ~ "/")` as defense in depth. Keep the check in a
+  small private @safe function so it is directly unit-testable without
+  spinning up the mock HTTP server.
+- Valid relative paths (plain names, `scripts/build.sh`) are untouched —
+  proven by the existing custom-build integration test and smoketest.
+
+### Range-check before cast (config.d)
+- TOML integers parse as `long`; `cast(int)` silently truncates huge
+  values (5000000000 → negative). Always range-validate before casting
+  (1..1024 for jobs), warn to stderr, and fall back to the default. This
+  mirrors the existing `parseIntOr` warning pattern already used for env
+  vars.