[nayan-kunwar]

Fixes #2.

What

generateManifest() interpolated absolute host paths into single quotes with no escaping — broken Windows builds (\t, \n, \x mis-decode) plus ' injection surface.

Changes

• packages/core/src/file-routes.ts: all emitted literals via JSON.stringify; readRouteModule label now relative POSIX importPath(entry.file) instead of absolute entry.file (no host path leak).
• packages/cli/src/commands/build.ts:66: await import via JSON.stringify(entryImport).
• packages/core/src/file-routes.test.ts: updated expects to double-quoted form; added 2 tests (' in filename, relative-not-absolute diagnostics).
• Changeset: patch for @theoven/core + @theoven/cli.

Left out intentionally: cli/templates.ts:156 (same pattern, different feature — follow-up).

Verified

• Repro before: manifest contained 'C:\Users\nayan...o'brien routes...' with raw backslashes + unescaped quote.
• After: "./o'brien.get.ts", no absolute path.
• bun test packages/core/src/file-routes.test.ts — 75 pass.
• bun run typecheck — clean.