fix(project): prevent output-dir: ./ from deleting project directory

[cderv]

When _quarto.yml contains output-dir: ./, running quarto render would delete the entire project directory, leaving only an empty .quarto/ directory.

Root Cause

Two compounding issues in the output directory handling:

1. The special case in project-context.ts:306-308 only checked for exact string ".":

if (projectConfig.project[kProjectOutputDir] === ".") {
  delete projectConfig.project[kProjectOutputDir];
}

This missed "./" and other equivalent variations.

2. The deletion logic in project.ts:287-291 used string comparison:

if ((realOutputDir !== realProjectDir) &&
    realOutputDir.startsWith(realProjectDir)) {
  removeIfExists(realOutputDir);
}

After path normalization, . and ./ produce different strings (e.g., C:\project vs C:\project\), causing the safety check to incorrectly pass.

Why resolve() instead of normalize()

We verified empirically that normalize() doesn't work for this case:

• normalize("./") → .\ on Windows (keeps trailing separator)
• normalize(".") → .

But resolve() correctly handles all variations:

• resolve(dir, ".") and resolve(dir, "./") both → same absolute path
• This works consistently across platforms

Fix Approach

1. Use resolve() for path comparison - handles all current-directory variations (., ./, .\, ././, etc.)

2. Replace removeIfExists with safeRemoveDirSync as defense in depth - this function uses proper isSubdir boundary checking and throws UnsafeRemovalError if someone attempts to delete the project directory

Test Plan

• Unit test verifying resolve() behavior for path equivalence (platform-aware: .\ only tested on Windows)
• Smoke tests for output-dir: ./, output-dir: ., and output-dir: _output
• All tests verify marker files survive rendering

Fixes #13892

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.