fix: deny dot path segments in all three (#70)

[abienkowski]

Description

Closes #70.

The router let exec and attach paths hide behind dot segments. In GET /./exec/<id>/json or GET /x/../exec/<id>/json the first segment is . or x, so the exec check missed it and the read passthrough forwarded it; POST /containers/x/./start was even routed as a container start. The daemon answers dot-segment paths with a 301 to the clean path, so nothing leaked, but the router allowed paths it should deny and relied on daemon behaviour the proxy does not control.

What changes

• All three routers deny any path with a segment that is exactly . or .., for every method, with dot path segment not allowed. The check sits right after the // check (Deferred minor findings from the #43/#47/#50/#51 review cycles #55) and before the API-version strip, on the path without its query. Names such as .hidden, a.b and ... are unaffected; %2e is already denied by the % check (Percent-encoded container names: Go routes on the decoded path, Rust/TS on the raw path #53); --readonly still runs first.
• The path is denied, not normalised (as noted on Router allows exec paths hidden behind dot segments (/./exec, /x/../exec) #70 from the fix: deny empty interior path segments; allow HEAD on named containers in Rust (#55) #71 review): routing a cleaned path would mean forwarding a different path from the one routed, and would weaken the TS absolute-form protection, which rests on the // check.
• Spec (spec/router.qnt): . and .. join WORDS; flag ALLOW_DOT_SEGMENTS; the rule-level property dotSegmentsDenied and the security property dotSegmentsHideNoExec (a path that is an exec or attach path once its dot segments are resolved is denied; it mentions neither the rule nor the flag); rows; and router_pre70, which witnesses both the exec and the attach halves of the old gap.
• Tests: the same 13-row table in Go, Rust and TS (8 rows discriminate), a TS query-string row, and three integration checks with curl --path-as-is.
• Docs: README endpoint table and prose, spec/README.md, AGENTS.md counts.

Review notes

• Release: merging cuts v0.3.11 (patch). Simulated squash: bump=patch tag=v0.3.11.
• The extra model words add about 3–4 s to make test-spec.

Verification

• Spec mutation: router with ALLOW_DOT_SEGMENTS = true fails dotSoundTest and the three dot* rows; router_pre70 asserts both properties fail and that GET /./exec/abc and GET /./containers/attach were allowed.
• Before the fix (6523ea9), the same 8 deny rows fail in Go, Rust and TS; the new integration checks on the pre-fix Go code:

  FAIL: GET /./exec/*/json -> 403 (dot segment) (expected 403 with "dot path segment not allowed", got 301: )
  FAIL: GET /x/../exec/*/json -> 403 (dot segment) (expected 403 with "dot path segment not allowed", got 301: )
  FAIL: GET /containers/./json -> 403 (dot segment) (expected 403 with "dot path segment not allowed", got 301: )
  60 PASSED, 3 FAILED
  

• This branch: make test-all Go 113, Rust 145, TS 164 (1 skipped); make lint-all, make test-spec (10 runs), make verify pass; integration ALL 63 TESTS PASSED for Go, Rust and TS; socket suite ALL 15 TESTS PASSED.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Implementation(s) changed

• Go
• Rust
• TypeScript
• Quint specification
• CI / infrastructure

Testing

• Unit tests pass (make test-all)
• Integration tests pass (63 per implementation; socket suite 15)
• Quint verification passes (make verify, make test-spec)
• New tests added for the change

Checklist

• I have read CONTRIBUTING.md
• My code follows the project's coding style
• I have updated documentation as needed