Enforce path traversal boundaries for autonomous filesystem reads (DreamService)

Description

The ReAct loop in DreamService natively loads raw files based on autonomous agent payloads via fs.readFileSync. To prevent capabilities from triggering unintended out-of-bounds reads (path traversal attacks like ../../../etc/passwd via hallucination), we must enforce a strict resolution boundary.

Implementation Overview

• Apply path.relative against the designated neoRootDir and the payload's targetPath.
• Intercept and reject any path that attempts to resolve outside the directory scope.
• Return a "Security Error" to the model loop for self-correction instead of failing silently.