fix: resolve project root correctly from the new build location

Both projectRoot computations were off by a level after the move: vector.ts
landed one directory above the repo root, and safety.ts's default audit-log
path landed in packages/ rather than the repo root that .env.example and
.gitignore both document. Verified empirically against the built entrypoint.

packages/builder/src/vector/safety.ts

@@ -8,7 +8,10 @@ const VECTOR_SPEND_LIMIT_DAILY = parseInt(process.env.VECTOR_SPEND_LIMIT_DAILY |
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-const projectRoot = resolve(__dirname, '../..');
+// From the bundled entrypoint's directory (packages/builder/build), three levels
+// up lands on the repo root, which is where .env.example and the README document
+// the default audit log path (./vector-audit-log.json) as living.
+const projectRoot = resolve(__dirname, '../../..');
 
 export class SafetyLayer {
   private dailySpent: number = 0;

packages/builder/src/vector/vector.ts

@@ -24,7 +24,9 @@ import type {
 
 // Direct .env loading
 const __filename = fileURLToPath(import.meta.url);
-const projectRoot = resolve(__filename, '../../../../..');
+// From the bundled entrypoint at packages/builder/build/index.js, four levels
+// up from the file lands on the repo root (build -> builder -> packages -> root).
+const projectRoot = resolve(__filename, '../../../..');
 const envPath = resolve(projectRoot, '.env');
 
 if (existsSync(envPath)) {