Harden gh CLI tool sandbox boundary against host file access

[daiv-agent]

The gh CLI tool runs in the DAIV worker process, not the sandbox, so file-operand actions and host-path arguments were a sandbox-boundary escape: gh release upload <tag> /run/secrets/x could exfiltrate host files and gh run download -D /home/daiv/... could write attacker-influenced artifacts to arbitrary host paths. This change closes those holes at the allowlist, argument-validation, and subprocess-execution layers.

Key Changes:

• Removed download from the run allowlist and restricted release to list/view only (dropping download, edit, upload), blocking all file-operand actions that read or write host files.
• Added --body-file (both --body-file <path> and --body-file=<path> forms) to _gh_has_disallowed_cli_flags, preventing issue/PR bodies from being populated from host files.
• Added _gh_has_path_traversal_args, which rejects any argument that is an absolute path or contains a .. path segment, while leaving non-path values like a bare .. (jq recursive descent) or tags such as v1..2 untouched.
• Pinned the gh subprocess cwd to a fresh tempfile.mkdtemp(prefix="gh-cli-") directory, cleaned up via shutil.rmtree(..., ignore_errors=True) in a finally block — defense in depth so any residual file operand resolves only inside the throwaway dir.
• Updated the tool's hard rules and the middleware's GITHUB_TOOL_DESCRIPTION schema to document the --body-file, absolute-path, and .. restrictions.
• Added TestGitHubToolSandboxBoundary covering rejection of release upload/download/edit, run download, --body-file exfiltration, absolute-path and .. arguments, tempdir pinning/cleanup, and that allowed read-only commands still execute.

---

⚠️ DAIV can make mistakes. Please review the changes and merge the MR if everything looks good.
🔗 Generated by DAIV — view sessions

---

💡 Instructions for the reviewer:

• 💬 Just leave comments/reviews mentioning @daiv-agent to get DAIV to address them for you.