[codex] Tolerate absolute file tool paths

[brandonkachen]

Summary

Keep file-editing tool prompts relative-path-first while making the SDK tolerant of absolute paths that resolve inside the project directory where the Codebuff CLI was started.

Root Cause

Absolute paths inside the project were failing in two places:

• requestOptionalFile read absolute paths through read_files, which normalized successful reads to relative keys, but then looked up the original absolute key.
• changeFile rejected every absolute edit path as traversal, even when the path resolved inside the project root.

Changes

• Added a shared SDK helper to resolve file paths against the project root and reject paths outside it.
• Added getProjectPathLookupKeys() so optional-file lookup does not duplicate knowledge of how getFiles() keys normalized paths.
• Updated file reading, optional file lookup, and file writing to tolerate in-project absolute paths.
• Kept str_replace and write_file schema/tool documentation relative-path-first so absolute paths remain client-side tolerance rather than first-class agent guidance.
• Simplified changeFile to a single-change flow instead of batch-style arrays.
• Added coverage for in-project absolute paths, sibling-prefix escapes, optional-file lookup keys, and valid filenames such as ..config.

Validation

• bun test sdk/src/__tests__/path-utils.test.ts sdk/src/__tests__/change-file.test.ts sdk/src/__tests__/read-files.test.ts sdk/src/__tests__/run-file-filter.test.ts
• bun run --cwd sdk typecheck
• bun run --cwd common typecheck