fix: address volume scopes review findings

- CRITICAL: validate volume Name against path traversal (safe regex)
- HIGH: log data migration errors instead of silently ignoring
- HIGH: reject empty source when switching from ephemeral scope

internal/store/store.go

@@ -116,10 +116,17 @@ func (s *Store) runMigrations() error {
 	}
 
 	// Data migration: copy mode→scope for volumes that have scope still empty.
-	// shared→project, isolated→instance.
-	_, _ = s.db.Exec(`UPDATE volumes SET scope = 'project' WHERE scope = '' AND mode = 'shared'`)
-	_, _ = s.db.Exec(`UPDATE volumes SET scope = 'instance' WHERE scope = '' AND mode = 'isolated'`)
-	_, _ = s.db.Exec(`UPDATE volumes SET scope = 'project' WHERE scope = '' AND mode = ''`)
+	// shared→project, isolated→instance. Log errors but don't fail startup.
+	dataMigrations := []struct{ query, desc string }{
+		{`UPDATE volumes SET scope = 'project' WHERE scope = '' AND mode = 'shared'`, "migrate shared→project"},
+		{`UPDATE volumes SET scope = 'instance' WHERE scope = '' AND mode = 'isolated'`, "migrate isolated→instance"},
+		{`UPDATE volumes SET scope = 'project' WHERE scope = '' AND mode = ''`, "migrate empty→project"},
+	}
+	for _, dm := range dataMigrations {
+		if _, err := s.db.Exec(dm.query); err != nil {
+			fmt.Printf("volume scope migration warning (%s): %v\n", dm.desc, err)
+		}
+	}
 
 	return nil
 }