fix(ops): harden provenance gate path and command parsing

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>

tests/adapters/persistence/test_ops_checks.py

@@ -160,3 +160,22 @@ def test_isolate_dirty_checkout_files_copies_dirty_and_untracked(tmp_path):
     assert (isolated / "tracked.txt").read_text(encoding="utf-8") == "dirty\n"
     assert (isolated / "new.txt").read_text(encoding="utf-8") == "new\n"
     assert (isolated / "manifest.json").is_file()
+
+
+def test_collect_release_provenance_rejects_runtime_path_escape(tmp_path):
+    repo, head = _init_git_repo(tmp_path)
+    report = collect_release_provenance(
+        actor="operator-a",
+        reason="deploy",
+        instance="inst-a",
+        command_class="manual-start",
+        checkout_dir=repo,
+        expected_oci_revision=head,
+        runtime_files=["../outside.txt"],
+        capture_commands={},
+        broker_log_path=None,
+    )
+    runtime = report["runtime_file_verification"][0]
+    assert runtime["path_within_checkout"] is False
+    assert runtime["matches_expected_revision"] is False
+    assert report["gate"]["passed"] is False