Refuse an origin.repo of /, the home directory or a relative path

Every run hashes the python files below origin.repo, so saving or syncing
a flow with one of those now answers 422 with what to do instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

backend/tests/api/routes/test_sync.py

@@ -9,7 +9,7 @@ from fastapi.testclient import TestClient
 
 from fluksio.core.config import settings
 from fluksio.sdk import FLOWS, MARKER, SyncError
-from fluksio.sdk.client import Client, sync
+from fluksio.sdk.client import ApiError, Client, sync
 
 EXAMPLES = Path(__file__).parents[4] / "examples"
 PREFIX = settings.API_V1_STR
@@ -47,6 +47,15 @@ def commits() -> int:
     return int(result.stdout.strip()) if result.returncode == 0 else 0
 
 
+@pytest.mark.parametrize("repo", ["/", str(Path.home()), "examples"])
+def test_sync_refuses_a_repo_every_run_would_walk_the_disk_for(api, flows, repo):
+    with pytest.raises(ApiError) as refused:
+        sync([flows["train"]], api, origin={**ORIGIN, "repo": repo})
+
+    assert refused.value.status == 422
+    assert "origin.repo" in str(refused.value.detail)
+
+
 def test_sync_stores_a_runnable_flow_with_its_origin(api, flows):
     reports = sync([flows["train"]], api, origin=ORIGIN)