Replace string-based startswith() path traversal guards with robust
Path.relative_to() across three files to prevent prefix-collision
bypass attacks. The old checks using str(target).startswith(str(root))
could be evaded by paths like /tmp/abc123-escape when root is /tmp/abc123.
Files patched:
- src/cleveragents/skills/builtins/file_ops.py (validate_sandbox_path)
- src/cleveragents/resource/handlers/_base.py (_safe_resolve)
- src/cleveragents/application/services/llm_actors.py (_write_to_sandbox)
ISSUES CLOSED: #7478
HAL9000