fix: keep builder file operations under project root

[maxts0gt]

Summary

• resolve Agent Builder file paths against the session project root
• reject absolute, parent-directory, and symlink paths that escape that root
• add regression coverage for read/write/delete file tools refusing outside paths

Tests

• uv run --with pytest --with pytest-asyncio pytest tests/unittests/cli/built_in_agents/test_builder_file_paths.py
• uv run --with pyink pyink --check src/google/adk/cli/built_in_agents/utils/resolve_root_directory.py tests/unittests/cli/built_in_agents/test_builder_file_paths.py

[rohityan]

Hi @maxts0gt , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Please fix formatting errors.

[DeanChensj]

Thanks @maxts0gt for the great PR! This issue has been resolved in 1fa7cda, so I'm going to close this for now. You are more than welcome to contribute in the future!