Project-development pipeline is vulnerable to path traversal / arbitrary file deletion

skills/project-development/scripts/pipeline_template.py builds batch directories directly from the --batch-id argument and then deletes files inside them (stage_clean). Because batch_id is not sanitized, a value like ../../other-directory can delete matching files outside the intended DATA_DIR.

Labels: security, bug, data-loss

Impact: Arbitrary file deletion and potential data loss outside the pipeline working directory.

Suggested fix:

1. Sanitize batch_id to a strict allow-list (e.g., [A-Za-z0-9_-]+).
2. Resolve batch_dir and verify it is contained within DATA_DIR.resolve().
3. Reject any batch ID containing path separators or ...
4. Add unit tests for traversal attempts.