feat(security/tools): 为 file/grep/glob 接入统一结果安全过滤

[Cai-Tang-www]

Summary

• 为 file / grep / glob 引入统一路径结果过滤器，集中处理工作区边界、敏感路径、符号链接逃逸检查。
• read_file 在读取前接入同源过滤规则，命中策略时返回结构化阻断错误。
• grep 与 glob 在候选结果阶段统一过滤，并补充统计元数据：matched_count、filtered_count、returned_count、filtered_reasons。
• 新增与增强测试覆盖：敏感路径过滤、symlink escape 过滤、原因码与统计元数据断言。

Test

• go test ./internal/tools/filesystem/...
• go test ./...

Closes #151
Refs #98

[codecov]

Codecov Report

❌ Patch coverage is 85.56701% with 28 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/tools/filesystem/result_filter.go	73.68%	5 Missing and 5 partials ⚠️
internal/tools/bash/executor.go	89.87%	4 Missing and 4 partials ⚠️
internal/tools/bash/tool.go	75.00%	2 Missing and 2 partials ⚠️
internal/tools/filesystem/glob.go	92.00%	1 Missing and 1 partial ⚠️
internal/tools/filesystem/grep.go	93.10%	1 Missing and 1 partial ⚠️
internal/tools/filesystem/read_file.go	71.42%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!