feat: complete client runtime foundation

tests/test_config.py

@@ -73,6 +73,18 @@ class ConfigTests(unittest.TestCase):
             with self.assertRaisesRegex(ConfigError, "unknown jobs"):
                 ClientConfig.load(path)
 
+    def test_state_and_backups_cannot_live_under_data_roots(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            path = root / "client.toml"
+            nested = _config(root).replace(
+                f'state_db = "{root / "state.db"}"',
+                f'state_db = "{root / "qb/state.db"}"',
+            )
+            path.write_text(nested, encoding="utf-8")
+            with self.assertRaisesRegex(ConfigError, "outside data roots"):
+                ClientConfig.load(path)
+
 
 def _config(root: Path, role: str = "cache") -> str:
     return f'''client_id = "cache-1"