[danjboyd]

Summary

• Bind cached eocc entries to the current template root and derive stale cleanup candidates from validated logical paths under the selected output directory. Cached output_path is checked for consistency but never used as deletion authority.
• Check canonical containment and reject symlinks below the output root; remove only regular generated files, never a manifest-named directory.
• Preserve legitimate stale removal and unchanged-output reuse; document the cache behavior in the CLI reference and getting-started guide.

Evidence

• Base: main 47c9eec55ad35de14d35bd4713294cc73997eb02.
• The new boundary regression run against the previous eocc binary failed for copied, forged absolute, traversal, symlink and manifest-named directory cases; on this branch it passes.
• Apple XCTest focused tests pass: outside-root manifest boundary, changed logical destination cleanup, disappeared-template cleanup with reuse, and malformed/unsupported manifest failure cleanup.
• git diff origin/main --check passes. Local docs gate cannot run because pandoc is absent; normal draft PR CI will verify it.

This is an isolated eocc CLI/compiler change. No module, runtime ABI, CI suppression or release changes.