chore: stop sharing a cache with the binary the audit job runs

build.rs

@@ -25,6 +25,14 @@ fn install_dir(shell: Shell) -> Option<(PathBuf, bool)> {
 }
 
 fn main() -> Result<(), Error> {
+    // naming any rerun-if condition replaces cargo's default of re-running the
+    // script whenever anything in the package changed, so everything that
+    // shapes a completion script has to be named here. without them an
+    // installed script goes stale against the binary it completes
+    println!("cargo::rerun-if-changed=build.rs");
+    println!("cargo::rerun-if-changed=src/cli");
+    println!("cargo::rerun-if-changed=Cargo.toml");
+
     println!("cargo::rerun-if-env-changed=SHELL_COMPLETIONS_DIR");
     for shell in Shell::value_variants() {
         println!(
@@ -40,7 +48,18 @@ fn main() -> Result<(), Error> {
             continue;
         };
 
-        fs::create_dir_all(&dir)?;
+        // a build script's working directory is the package root, so a relative
+        // dir would quietly install into the source tree and one holding `..`
+        // somewhere else again. only a path that says where it means is taken
+        if requested && !dir.is_absolute() {
+            return Err(Error::other(format!(
+                "the completions directory must be an absolute path, not {}",
+                dir.display()
+            )));
+        }
+
+        fs::create_dir_all(&dir)
+            .map_err(|e| Error::other(format!("creating {}: {e}", dir.display())))?;
         let path = generate_to(*shell, &mut cmd, env!("CARGO_PKG_NAME"), &dir)?;
 
         if requested {