…ensitive paths
- Add validateUploadSourcePath/validateSourcePath helpers that reject paths
  under /etc, system dirs, .git directory components, and HOME credential
  locations (.ssh, .aws, .gnupg, .docker, etc.)
- Add validateAllowedRoot to restrict absolute paths to staging dir,
  GITHUB_WORKSPACE, and RUNNER_TEMP only
- Canonicalize paths with fs.realpathSync before policy checks to prevent
  traversal escapes and symlink chains
- Apply restrictive permissions (0o600) on all staged files in both
  safe_outputs_handlers.cjs and upload_artifact.cjs copySingleFileToStaging
- Clean up upload and download temp directories in artifact_client.cjs
  using try/finally blocks in success and failure paths
- Add security tests covering /etc rejection, .git component rejection,
  out-of-bounds root rejection, allowed workspace paths, and 0o600 perms
- Update auto-copy tests to set GITHUB_WORKSPACE so they match the new
  allowed-roots policy
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…alpathSync error
- Use canonicalFilePath (not filePath) in the allowed-root error message so the
  resolved path is always shown, preventing misleading messages on traversals
- Replace silent path.resolve fallbacks with explicit errors when fs.realpathSync
  fails, eliminating any risk of a non-canonical path bypassing validation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan marked this pull request as ready for review

… recursive copy
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

…puts_handlers
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan deleted the copilot/restrict-artifact-uploads branch