FileGrepTask: give the filesystem surface a distinct `path` input port instead of overloading `url`

[sroussey]

What

FileGrepTask's single url input carries three different things:

• an http:// / https:// URL, handled by the base build through FetchUrlTask;
• a file:// URL, handled only by the server build;
• a bare filesystem path, handled only by the server build.

That is why the input schema description has to enumerate the whole story, why the base class doc had to be corrected, and why the server build has to sniff the string to decide which surface it is on. A UI rendering the port cannot tell the user which of the three it wants, and an authoring LLM has to infer it from prose.

A distinct path input port would make the two surfaces separable: url stays http(s)-only and matches what the base class can actually do, path is server-only and is the port the filesystem:read entitlement scopes.

Why it was not done in the hardening PR

It is an input-schema break for every existing workflow that stores a filesystem path in url, plus a UI change. Deferred deliberately rather than smuggled into a security fix.

Sketch

• add an optional path port (server build only, or base with a "not available here" error)
• keep url accepting a filesystem path for one release, with a deprecation note in its description
• migrate stored workflows, then narrow url to format: "uri" http(s)

Follow-up to PR #821.