fix(security): reject path traversal in build_script and validate default_jobs range

.omo/notepads/tofu-core/problems.md

@@ -36,3 +36,24 @@ everywhere else).
 
 Verified: `dub build` ✓, `dub test` — 23 modules passed ✓, smoketest — 16 checks PASS ✓.
 
+
+## RESOLVED (F2 review, 2026-08-08)
+
+**Fixed:** Both F2 findings.
+
+1. **BLOCKER — path traversal in fetch.d (`build_script`)**: extracted
+   `validateBuildScriptPath(string)` (private @safe) — rejects `..`
+   segments, leading `/`, and `\` with `FetchException("build_script path
+   is unsafe: <path>")`. Wired into `fetchRecipe` step 4 before building
+   `bsUrl`/`bsDest`, plus defense-in-depth containment check
+   (`bsDest.startsWith(cacheDir ~ "/")`). Added direct unit tests and an
+   integration test (recipe with `build_script = "../../evil.sh"` →
+   FetchException, no file escapes the cache).
+
+2. **MAJOR — `cast(int)` truncation in config.d `default_jobs`**:
+   range-validate before casting. `tJobs < 1 || tJobs > 1024` → stderr
+   warning + fallback to 1. Added tests for 5000000000→1, 1024→1024,
+   2048→1, -3→1.
+
+Verified: `dub build` ✓, `dub test` — 23 modules passed ✓,
+smoketest — 16 checks PASS ✓.