Add text parameter type; verify commands run in the owning repo root

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

rtut/pack.py

@@ -120,7 +120,10 @@ def render(command: str, values: dict[str, str], pack: Pack) -> str:
             raise ValueError(f"parameter {name}: {val!r} not in {p['values']}")
         if p.get("pattern") and not re.fullmatch(p["pattern"], val):
             raise ValueError(f"parameter {name}: {val!r} violates pattern")
-        if re.search(r"[;&|`$<>\n\\'\"\s]", val) and p.get("type") != "path":
+        # "text" is single-line free text meant to sit inside double quotes:
+        # spaces are allowed, shell metacharacters are not.
+        bad = r"[;&|`$<>\n\\'\"]" if p.get("type") in ("text", "path") else r"[;&|`$<>\n\\'\"\s]"
+        if re.search(bad, val):
             raise ValueError(f"parameter {name}: unsafe characters")
         return val