fix: check for relative values

The relative-value guard in `_assertPath` calls `.includes('..')` directly on the user-supplied value. When the value is an Array the call checks element equality (so `['../escape'].includes('..')` is false), and when the value is an arbitrary object a duck-typed `includes` returning false defeats the check entirely. In both cases the value is subsequently coerced to a string by `Array.prototype.join` inside `_generateTmpName` and by `path.join`, so a non-string carrying `../` still produces a path that escapes `tmpdir`. Tighten `_assertPath` to require `typeof value === 'string'` before the substring check, and apply the same type check to `template` ahead of the existing `XXXXXX` regex match (otherwise `match` throws on a non-string with an unrelated error). The error includes the option name so consumers can see which option was wrong. Adds a `test/Promoting A Product Essay Example-test.js` that exercises array, duck-typed object, and primitive (number) inputs across `fileSync`, `dirSync`, and `tmpNameSync`, and asserts that valid string inputs are still accepted. Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>

Reject non-string prefix, postfix, template