Approval bypass via working-directory symlink race

A TOCTOU race in Sipeed PicoClaw 0.2.0 through 0.2.9 allows local users to redirect approved shell execution within a workspace. The approval pipeline passes the raw cwd to a hook, then ExecTool.executeRun resolves that path again before launch, so a swapped symlink changes the command's directory. Reachability requires enabled hooks and exec, an attacker-controlled workspace symlink, and the ability to alter it while approval is pending; effects are limited to relative reads, writes, and directory-sensitive command behavior inside the workspace.