Path traversal in runtime file I/O allows escaping port directories #536

While reviewing runtime I/O paths, I noticed we trust the name argument when building input/output file paths. Right now that value can include ../ segments and escape the expected port directory. In practice this means a node can read or overwrite files outside the study workspace if it passes a crafted filename.

This affects local and docker-style runtimes (Java and Python code paths). It’s not just a bad input edge case; it’s a boundary break in core IPC.

Expected behavior,
resolve the final path and reject anything that does not stay under the intended port directory. Same guard should be applied consistently to both read() and write() paths.