Validate the sqlite-vec cache root before extraction

[ian-pascoe]

What to build

Validate the configured cache root before any sqlite-vec filesystem operation. Empty or relative XDG cache values must not cause extraction or permission changes beneath the current Project.

Acceptance criteria

• Empty and relative cache environment values are rejected or replaced with the documented absolute user-cache default.
• Every extraction destination is absolute before directories or files are created or chmodded.
• Digest verification, atomic extraction, restrictive permissions, and application fallback behavior remain intact.
• Tests cover empty, relative, and valid absolute cache values.
• The full verification command passes.

Blocked by

None (can start immediately).