fix: add path traversal guard for {file:path} config interpolation

Found during v0.5.21 release review. The `{file:path}` substitution in `config/paths.ts` has no path traversal guard — `{file:../../etc/passwd}` or `{file:~/.ssh/id_rsa}` would be resolved. Currently low risk since configs are user-authored, but should be hardened if configs are ever loaded from less-trusted sources (e.g. shared repo `.opencode/opencode.json`).

Deferred because: requires design (path jail under config dir or project root, ~45 min).