Refactor/s4 paths

[missabawse]

For issue #28

Summary

• Adds scripts/config/paths.ts — 24 pure, cwd-based path helpers covering every pipeline stage
  (transcribe, edit, sync, camera, shorts, carousel, thumbnail). No filesystem reads, all helpers
  default cwd to process.cwd().
• Eliminates the two-source-of-truth risk for .ragtech/ paths by importing
  PROJECT_DIR/PROJECT_FILENAME from project.ts and ARTIFACTS_DIR from artifacts.ts instead
  of hardcoding the strings again.
• Internal dir helpers (e.g. transcribeRawDir, carouselDir) are kept private — only
  file/artifact paths are exported, so the public API surface is stable for later script migrations.
• Pins ws >= 8.21.0 and brace-expansion >= 5.0.6 in package.json overrides to clear 7
  moderate npm audit vulnerabilities that were blocking the pre-push hook.

How to review

File	What to check
scripts/config/paths.ts	Each helper returns the exact path that the corresponding script
currently hardcodes (cross-reference with grep hits in edit-transcript.js, shorts-wizard.js,
carousel-wizard.js, etc.). Private helpers have no export. projectFile/artifactDir
delegate to imported constants, not raw strings. Guards on shortClipDir/carouselClipDir for
empty id.
scripts/config/paths.test.ts	Expected values are hardcoded string literals (not path.join)
so they pin exact output. Guard tests confirm RangeError on syncedVideoAngle(0) and
TypeError on empty id. cwd defaults test uses startsWith/endsWith, not a tautological
reconstruction.
package.json	Only the overrides block changed — two entries added. No dependency versions
touched directly.

Test plan

• npm test passes (30 new unit tests in paths.test.ts, all green)
• npm run test:react passes (if React/Remotion components changed)
• npm run test:e2e passes (if Phase 8 user-facing flows changed)

Manual verification:

• N/A — no Remotion components or UI routes changed.

Checklist

• Behaviour parity — additive only; no existing scripts modified, nothing to smoke-test
• tsc --noEmit passes
• No new hardcoded paths in scripts/; no new duplicated timing constants in remotion/
• Type shapes match spec — no new JSON artifact fields; no types changed
• Scope discipline — only scripts/config/paths.ts, scripts/config/paths.test.ts, and
  package.json (overrides) touched