fix(mcp): confine local attachment transfers to the working directory

[jlrickert]

Summary

Local tap mcp accepted any absolute source_path, file: URI, or dest_path. A prompt-injected agent could upload ~/.ssh keys to a keg or overwrite a shell rc file.

• Upload sources must resolve to regular files inside the server's working directory. Parent traversal, symlink escapes, and paths that change under environment expansion are refused.
• Download destinations must be new files inside that directory. They are created with O_EXCL and 0600, so an existing file or a final symlink is never overwritten.
• The local image_download tool is no longer annotated read-only.
• Hosted MCP is unchanged, and so is the CLI's explicit local file handling.

Testing

• New pkg/mcp/transfer_security_test.go covers traversal, symlink escape, overwrite refusal, and the happy paths
• go build, go vet, go test ./..., -race for keg/tapper/parity
• task lint:docs, task lint:fs

[jlrickert]

Converting to draft: the working-directory confinement breaks existing local attachment transfers (uploads/downloads outside the MCP server's cwd, re-downloads to existing paths). Needs another pass before merging.