Sandboxed command execution via external pipeline traversal

Path traversal in Chainguard melange 0.32.0 through 0.43.3 allows attackers to read local files and execute sandboxed commands. The (*Compiled).compilePipeline function joins pipeline[].uses to each pipeline directory without rejecting absolute paths or parent-directory segments, then parses the escaped YAML file as a pipeline. Exploitation requires a melange build to process an attacker-influenced configuration, after which an out-of-tree runs block executes through /bin/sh -c inside the build sandbox.