Define recipe template asset access by source

What problem would this solve?

Recipe templates can reference companion files, but a local directory may also contain unrelated data, and a source-less shared recipe has no companion directory of its own. Users need a clear asset-access contract.

What would a good outcome look like?

Which local files may file-backed and source-less recipes include or extend without another user decision, and what binding or consent authorizes those assets?

Possible approaches

Consider explicit asset declarations, package roots or user-visible dependency approval while preserving legitimate sibling/nested templates. Directory containment remains necessary but does not define which in-directory files are trusted assets. Avoid assuming hidden filenames are the only sensitive data.

Additional context

Verification should cover local project recipes, source-less shared recipes, mixed-content directories, valid sibling/nested inheritance, missing dependencies and existing traversal protections. Apply the same authority rule during validation and final rendering.

• I have verified this does not duplicate an existing feature request

Do not begin implementation until the issue reaches Ready on the Goose Issues board.