fix: harden prerender publication boundary

scripts/config-argument.mjs

@@ -0,0 +1,16 @@
+export const parseExactConfigArgument = (arguments_) => {
+  if (arguments_.length !== 2 || arguments_[0] !== '--config') {
+    throw new Error('Prerender accepts exactly --config <path>.');
+  }
+  const configPath = arguments_[1];
+  if (
+    configPath.length === 0 ||
+    configPath.startsWith('/') ||
+    configPath.includes('\\') ||
+    configPath.split('/').some((part) => part === '' || part === '.' || part === '..') ||
+    !/^config\/[a-z0-9][a-z0-9._-]*\.json$/u.test(configPath)
+  ) {
+    throw new Error('Config must be a safe repository-relative JSON path inside config/.');
+  }
+  return configPath;
+};