dev-watch writes the reload pointer under artifacts/dev-reload/live-slots, a
sibling of slots; a slot-directory root refused every watch reload and the
reopen path. Test: a sibling directory loads inside an explicit root, not under
the default root, and an outside assembly is still refused.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The reload pointer, and the initial --client-assembly, named any path and ran
whatever it held in the engine process. Reload now refuses relative and UNC
paths and anything that, links followed, lies outside the trusted root
(--client-trusted-root or AQUARIUM_CLIENT_TRUSTED_ROOT; default: the directory
of the initial assembly). dev-reload passes its slot directory as the root.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
