fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs (#1004)

* fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs

Follow-up to the session snapshot/export tightening: the same invisible server-cwd resolution applied to open_binary target paths (parseBinaryTarget(path, process.cwd())), import_evidence_bundle bundle reads, firmware input files (resolve(raw)), browser executable launch paths (resolve-then-spawn), Electron executable/application/root paths (realpath on raw input), and the expected server path check.

Each field gains the shared isAbsoluteLocalPath refinement plus a catalog-visible description, since JSON Schema cannot express the rule. Examples, scenario fixtures, and contract tests updated to absolute paths; new schema cases cover rejection/acceptance/omission per field.

Explicitly unchanged (verified rooted or out of scope): inspect_plist paths (resolved against the target bundle dir), firmware output_directory (already provider-enforced), filesystem observation paths (resolved against the caller-supplied working_directory), keyed-archive member paths (archive-relative), JS evidence member paths (evidence-relative under root_alias), provider-internal execution schemas, CLI-only doctor flows, and CLI options (own resolve against the operator cwd).

* fix(cli): resolve operator-relative paths before shared absolute-path validation

The contract tightening rejects relative paths, but three CLI commands forward operator-relative input into the shared schemas: firmware commands pass raw args to FirmwareAnalysisService, and the Electron/browser scenario commands validate parsed scenario JSON directly. CLI paths are relative to the operator shell, so resolve them against the working directory first: resolve() in firmwareCommands, and a shared resolveCliJsonPaths JSON key-path helper (cliJsonInput) applied in electronCommands and cliBrowserScenarioCommands. MCP behavior is unchanged — MCP callers must still send absolute paths.

Covers the regression with a relative-path firmware CLI acceptance test (asserts provider-stage capability_unavailable, not a validation error) and unit tests for the helper.

src/domain/javascript/electronActiveObservation.ts

@@ -1,6 +1,11 @@
 import { z } from "zod";
 
-const pathInputSchema = z.string().trim().min(1);
+import { isAbsoluteLocalPath } from "../localPath.js";
+
+const pathInputSchema = z.string().trim().min(1).refine(isAbsoluteLocalPath, {
+  message:
+    "Electron executable, application, and root paths must be absolute local filesystem paths (for example /Applications/Electron.app/Contents/MacOS/Electron)",
+});
 const absolutePathSchema = z
   .string()
   .min(1)
@@ -60,9 +65,17 @@ const actionSchema = z.discriminatedUnion("kind", [
 
 /** Input for one explicit, provider-owned Electron runtime experiment. */
 export const electronActiveObservationInputSchema = z.strictObject({
-  executable_path: pathInputSchema,
-  application_path: pathInputSchema,
-  application_root: pathInputSchema.optional(),
+  executable_path: pathInputSchema.describe(
+    "Absolute local filesystem path for the Electron executable; relative paths are rejected.",
+  ),
+  application_path: pathInputSchema.describe(
+    "Absolute local filesystem path for the Electron application; relative paths are rejected.",
+  ),
+  application_root: pathInputSchema
+    .optional()
+    .describe(
+      "Absolute local filesystem root for application-relative paths; omit to derive it from the application path. Relative paths are rejected.",
+    ),
   args: z.array(z.string()).default([]),
   actions: z.array(actionSchema).default([]),
 });