Security: replace eval() with ast.literal_eval() and add path traversal checks

[johnpippett]

Fixes two critical security findings:

1. Arbitrary code execution via eval(): Replaced all eval() calls in LLM output handling, agent configs, and templates with ast.literal_eval() across 7 files.
2. Path traversal: Added _validate_path_containment() in resource_helper.py to ensure all file operations stay within the designated root directory.

Syntax validated; standalone verification confirms malicious payloads are rejected.

[Ujjawal0204]

Nice security pass. One edge case in the new containment check: in get_agent_read_resource_path(), validation happens before {agent_id} / {agent_execution_id} placeholders are expanded, while the write path validates after formatting.

If formatted names can contain path separators or traversal-like content, the final path may differ from the path that was validated. Could we either expand placeholders before _validate_path_containment(...) or revalidate after expansion for consistency with get_agent_write_resource_path()?

[johnpippett]

@Ujjawal0204 I took a local look and I think your concern is valid.

I reproduced the path-shape issue against ResourceHelper: placeholder expansion uses agent.name.replace(" ", "") / agent_execution.name.replace(" ", ""), so names containing path separators or traversal segments are not sanitized. With names like ../../escape, the final normalized resource path can land outside the intended workspace/output tree.

One extra finding: this is not limited to get_agent_read_resource_path(). The write path expands placeholders earlier, but then validates file_name against the already-expanded root. If that expanded root has already escaped the configured output base, validation still passes because it only proves the file is inside the escaped root.

So the safer fix is to either sanitize the formatted agent/run path components so they cannot contain /, \, or traversal-like segments, or validate the final normalized path after placeholder expansion against the original configured input/output base directory.