Fix overly broad ".." prefix check in cursor containment

validateCursorContainment and FindCursorSourceFile used
strings.HasPrefix(rel, "..") which rejects valid paths like
"..config/". Use separator-aware check matching isContainedIn.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: wesm

internal/sync/discovery.go

@@ -570,7 +570,9 @@ func FindCursorSourceFile(
 			continue
 		}
 		rel, err := filepath.Rel(resolvedRoot, resolved)
-		if err != nil || strings.HasPrefix(rel, "..") {
+		sep := string(filepath.Separator)
+		if err != nil || rel == ".." ||
+			strings.HasPrefix(rel, ".."+sep) {
 			continue
 		}
 		return candidate

internal/sync/engine.go

@@ -1132,7 +1132,9 @@ func validateCursorContainment(
 		return fmt.Errorf("resolve path: %w", err)
 	}
 	rel, err := filepath.Rel(resolvedRoot, resolvedPath)
-	if err != nil || strings.HasPrefix(rel, "..") {
+	sep := string(filepath.Separator)
+	if err != nil || rel == ".." ||
+		strings.HasPrefix(rel, ".."+sep) {
 		return fmt.Errorf(
 			"%s escapes %s", path, cursorDir,
 		)