[uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B)

### Summary

UK AI Open Code Governance review (7-day recent-change scope) identified an open code-scanning alert with no existing tracking issue.

**Alert**: `#655` — CodeQL `go/bad-redirect-check` (severity: error, CWE-601 URL redirection to untrusted site)
**Location**: `pkg/cli/add_package_manifest.go:579`, function `cleanManifestRelativePath`

### Risk-scoring breakdown (Tier B — Open With Conditions)

| Dimension | Rating |
|---|---|
| Exposure amplification | Low |
| Patchability | High |
| Detectability | High (CodeQL) |
| Operational fragility | Low |
| Ownership confidence | High |

### Assessment

The flagged code is a relative-path/traversal guard (`cleanManifestRelativePath`), not a redirect handler:

```go
func cleanManifestRelativePath(p string) (string, error) {
slashed := filepath.ToSlash(p)
if strings.HasPrefix(slashed, "/") || strings.HasPrefix(slashed, "\\") || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed) {
return "", errors.New("absolute paths are not allowed")
}
...
```

CodeQL's `go/bad-redirect-check` heuristic appears to have matched the `HasPrefix(slashed, "/")` pattern generically, without confirming the value flows into an HTTP redirect (`http.Redirect`/`Location` header). This is very likely a **false positive**, but it has not yet been triaged, dismissed, or fixed.

### Remediation action

- SLA urgency: **Medium**
- Action: Confirm whether the flagged value ever flows into an HTTP redirect. If not (expected), dismiss the CodeQL alert with a "false positive" reason referencing this analysis. If it does reach a redirect path elsewhere, add a `//`/backslash check consistent with the CWE-601 guidance.

### Discussion report

See the UK AI Open Code Governance discussion report created in this same workflow run for full asset-graph, tier classification, and control-verification context.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/32270911789) · auto · 43.9 AIC · ⌖ 2.57 AIC · ⊞ 9.3K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)