test(web): avoid path.join on a parameter in the rebrand scan

Semgrep flagged the directory walker as a possible path traversal. The walk
now runs from an absolute src root and builds child paths from directory
entries only.

web/src/lib/__tests__/voculinux-rebrand.test.ts

@@ -22,20 +22,23 @@ const read = (...segments: string[]): string =>
 const readPage = (...segments: string[]): string =>
   read("src", "app", ...segments);
 
-// Every non-test file under src, plus the sitemap, the README and PRODUCT.
-const walk = (relDir: string): string[] =>
+// Every non-test file under an absolute directory, as paths relative to ROOT.
+const walk = (absDir: string): string[] =>
   fs
-    .readdirSync(path.join(ROOT, relDir), { withFileTypes: true })
+    .readdirSync(absDir, { withFileTypes: true })
     .flatMap((entry) => {
-      const rel = path.posix.join(relDir, entry.name);
+      const abs = `${absDir}/${entry.name}`;
       if (entry.isDirectory()) {
-        return entry.name === "__tests__" ? [] : walk(rel);
+        return entry.name === "__tests__" ? [] : walk(abs);
       }
-      return /\.test\./.test(entry.name) ? [] : [rel];
+      return /\.test\./.test(entry.name)
+        ? []
+        : [path.posix.relative(ROOT, abs)];
     });
 
+// Every non-test file under src, plus the sitemap, the README and PRODUCT.
 const SCANNED_FILES = [
-  ...walk("src"),
+  ...walk(`${ROOT}/src`),
   "public/sitemap.xml",
   "README.md",
   "PRODUCT.md",