security: path traversal rejection, packet length validation; code quality

Security:
- Asset loader rejects paths containing ".." sequences (path traversal)
- Chat message parser validates length against remaining packet bytes
  before resize(), preventing memory exhaustion from malformed packets

Code quality:
- Extract 11 named geoset constants (kGeosetBareForearms, kGeosetWithCape,
  etc.) replacing ~40 magic number sites across 4 code paths
- Add build-debug/ and .claude/ to .gitignore
- Remove .claude/scheduled_tasks.lock from tracking

src/pipeline/asset_manager.cpp

@@ -604,6 +604,15 @@ std::string AssetManager::normalizePath(const std::string& path) const {
     std::replace(normalized.begin(), normalized.end(), '/', '\\');
     std::transform(normalized.begin(), normalized.end(), normalized.begin(),
                    [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+
+    // Reject path traversal sequences
+    if (normalized.find("..\\") != std::string::npos ||
+        normalized.find("../") != std::string::npos ||
+        normalized == "..") {
+        LOG_WARNING("Path traversal rejected: ", path);
+        return {};
+    }
+
     return normalized;
 }