Fix workspace citation path escape

[cursor]

Bug and impact

Artifact citation buttons passed model-provided paths directly to the open_path Tauri command. Because open_path accepted absolute paths and did not canonicalize/validate workspace containment, a crafted citation could make the app open an arbitrary local file or folder when clicked.

Root cause

open_path only trimmed the string, accepted absolute paths as-is, and joined relative paths to the workspace without reusing the workspace path jail used by agent tools.

Fix

• Resolve citation/open paths through a workspace-only helper.
• Preserve intended workspace/... citation paths and workspace-relative paths.
• Reject absolute paths outside the workspace, .. traversal, and symlink escapes before invoking the OS opener.
• Added regression tests for valid workspace paths, absolute escape, traversal, and symlink escape.

Validation

• cargo +stable test open_path --locked — 4 regression tests passed.
• cargo +stable test --locked — 35 Rust tests passed.