feat(sources): add canonical manifest path normalization and validation

[jony376]

Related issues

Closes #46

Summary

• add normalizeManifestLocalPath() to centralize manifest local path normalization + validation
• derive scope from normalized paths and reuse the helper in classifyScope
• harden resolveManifestPath with path.relative repo-root checks
• normalize/filter invalid sources rows in readProductMdManifest
• add unit tests for normalization, scope derivation, and unsafe traversal rejection

Why this is structural

This introduces a reusable path-normalization layer and rewires manifest ingestion to use it end-to-end, instead of scattered string handling.

Validation

• Added/updated unit tests in tests/unit/sources.test.ts
• Could not run Vitest in this environment because local Node is v18.19.0 while project Vitest/rolldown requires newer Node runtime.