fix(handlers): validateRelPath checks both raw and cleaned path for ..

The previous approach only checked the cleaned path, but filepath.Clean
resolves ".." upward so "foo/../bar" becomes "bar" and "foo/.." becomes
"." — making strings.Contains(clean, "..") pass when it shouldn't.

Fix: also check strings.Contains(filePath, "..") on the raw path.
This catches "foo/..", "foo/../bar", "../foo" etc. before Clean resolves them.

Update test case "path ends in .." to wantErr=true (raw path has "..").

workspace-server/internal/handlers/container_files_test.go

@@ -29,7 +29,7 @@ func TestValidateRelPath(t *testing.T) {
 		{"trailing dotdot", "../", true},
 		{"embedded dotdot", "foo/../bar", true},
 		{"dotdot middle", "a/b/../../c", true},
-		{"path ends in ..", "foo/..", false}, // Clean() resolves to "foo" — no .. left after clean
+		{"path ends in ..", "foo/..", true}, // raw contains ".." → reject (even if Clean() resolves it away)
 		{"bare ..", "..", true},
 
 		// Absolute: must be rejected