Contain workspace clone targets

[codeforester]

Summary

• Resolve the workspace root before cloning repositories.
• Reject repository targets whose symlinks resolve outside that root.
• Report the invalid target and continue with the remaining repositories.

Issue

Closes #1771

Validation

• Workspace-clone focused tests: 5 passed.
• Full base_projects Python suite: 1057 passed, 1 skipped, 251 subtests passed.
• compileall and git diff --check passed.

Security Notes

Repository clone destinations are checked after symlink resolution and must remain descendants of the resolved workspace root. A repository entry that escapes the workspace is rejected before invoking the clone operation.

Demo Impact

None.

Notes

• .ai-context/ is unchanged because this is a narrow implementation and regression-test fix.
• pylint was not run because it is not installed in the local environment.

Checklist

• Tests added or updated
• No unrelated changes