concore init accepts path-like project names and creates folders outside the current directory #588

concore init <name> uses the name directly as a filesystem path, so names like ../x or an absolute path create the project outside the directory the user is in. The name is never checked, and init_project() and init_project_interactive() in concore_cli/commands/init.py both do Path(name) followed by mkdir().

Repro:

1. mkdir work && cd work
2. concore init ../x
3. ls ..

The command succeeds and ../x now exists, containing src/, workflow.graphml, README.md and STUDY.json. Nothing was created inside work. A typo like concore init ../../my-study will quietly drop a project two levels up. The --interactive path behaves the same way.

Expected: a project name should be a single folder name. If it contains a path separator or .., the command should print a clear error such as Error: Project name must not contain path separators and exit without creating anything.

Actual: the folder is created wherever the path points.

Suggested fix (good first issue): add a small check at the top of both functions in init.py (or once in cli.py before they are called) that rejects names where Path(name).name != name or that are . / .., and add a test in tests/test_cli.py for ../x.

Tested on dev at d11e582, Python 3.12, Windows 11.