Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR` (CVE-2026-49986) | HOL Guard CVE