feat(core): add defense-in-depth workspace validation for directory expansion

Re-validate every file found during directory expansion to prevent traversal
via symlinks or other methods during recursion.

Related to #1489

packages/core/src/utils/pathReader.ts

@@ -87,6 +87,11 @@ export async function readPathFromWorkspace(
     );
 
     for (const filePath of finalFiles) {
+      // Defense in depth: validate each file found within the directory.
+      if (!workspace.isPathWithinWorkspace(filePath)) {
+        continue;
+      }
+
       const relativePathForDisplay = path.relative(absolutePath, filePath);
       allParts.push({ text: `--- ${relativePathForDisplay} ---\n` });
       const result = await processSingleFileContent(