fix: coord review remediations (path traversal, JSON parse, race condition) (#81)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

packages/coord/src/mission.ts

@@ -379,7 +379,14 @@ export async function loadMission(projectPath: string): Promise<Mission> {
     throw error;
   }
 
-  const mission = normalizeMission(JSON.parse(raw), resolvedProjectPath);
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Invalid JSON in mission file: ${filePath}`);
+  }
+
+  const mission = normalizeMission(parsed, resolvedProjectPath);
   if (mission.status === 'inactive') {
     throw new Error('Mission exists but is inactive. Re-initialize with mosaic coord init.');
   }