fix(context): block @ references from reading secrets outside the workspace

[Gutslabs]

What does this PR do?

Fixes a safety bug in @ context reference expansion.

Previously, CLI @file: / @folder: expansion defaulted to an unrestricted root, so absolute paths outside the current workspace could be attached directly into the prompt. Gateway expansion also allowed references to sensitive paths under the messaging working directory, including files like .hermes/.env and .ssh/id_rsa.

This change makes @ references default to the current working directory boundary and blocks known sensitive credential / internal Hermes paths even when they are technically inside the allowed root.

Type of Change

• Bug fix
• Security fix
• Tests

Changes Made

• Default allowed_root to cwd when expanding @file: and @folder: references
• Reject sensitive credential paths under $HOME such as .ssh/*, shell rc files, and similar secret-bearing files
• Reject internal Hermes paths such as $HERMES_HOME/.env and $HERMES_HOME/skills/.hub/...
• Added regression tests for workspace escape and sensitive path blocking

How to Test

1. Run source .venv/bin/activate
2. Run pytest -q tests/test_context_references.py
3. Confirm @file:/absolute/path/outside/workspace is refused by default
4. Confirm @file:.hermes/.env and @file:.ssh/id_rsa are blocked even when they are under the allowed root

Validation

• pytest -q tests/test_context_references.py -> 11 passed
• Direct repro before the fix allowed secret content from .hermes/.env and .ssh/id_rsa to be injected into the prompt