Normalize Windows paths without weakening plugin path boundaries

[Mineru98]

Problem

Several config and plugin paths are compared or validated using assumptions that are easier on Unix than on Windows. Windows drive paths, backslashes, CRLF config files, and directory junctions can cause path comparisons to be noisy or security checks to miss the real destination.

The plugin path policy should remain strict: configured plugin paths must stay inside allowed roots even when links or platform-specific path spelling are involved.

Proposed fix

Normalize path spelling where the application only needs stable comparison, while resolving existing path segments and links where the application enforces a trust boundary. Also make config and skill metadata parsing tolerate CRLF files.

Acceptance criteria

• Config loading preserves absolute Windows path spelling when appropriate.
• CRLF JSON config files parse normally.
• Plugin entrypoint and path validation reject Windows absolute paths and traversal through either slash style.
• Plugin path policy rejects link/junction escapes from allowed roots.
• Skill frontmatter parsing works with CRLF line endings.
• Path comparisons in tests are portable across Windows and Unix.

Related files

• lib/ourocode/config/raw_loader.ex
• lib/ourocode/plugin/config_validation.ex
• lib/ourocode/plugin/path_policy.ex
• lib/ourocode/command/registry/skill_loader.ex
• test/test_helper.exs