LocalFileSystem workspace path confinement is incomplete

[wutongyuonce]

Problem

LocalFileSystem exposes workspace-scoped filesystem operations, but its path confinement has two gaps:

1. Absolute paths are silently normalized as workspace-relative paths instead of being rejected. For example, /foo.json becomes workspace/foo.json, which can make callers operate on an unexpected file.
2. Symlink components are followed by filesystem operations, so a symlink inside the workspace can point outside the storage root and expose external files through workspace APIs.

Expected behavior

• Workspace filesystem APIs accept only workspace-relative paths.
• Absolute paths are rejected explicitly.
• Symlink components are rejected so all operations remain inside the configured storage root.

A fix and regression tests are proposed in #148.