Align read_file/write_file relative-path resolution with new tools

Background

New file tools (search_files, apply_patch, edit) resolve relative paths against the workspace directory before validating workspace containment. The older read_file and write_file tools do not; they validate the relative path as-is, which can fail when the server process CWD differs from the workspace root.

Because read/write aliases point to read_file/write_file, OpenClaw/Hermes agents passing relative paths to read or write may get "Access denied: path outside workspace" errors.

Expected behavior

Relative path arguments in read_file and write_file should be joined with workspaceDir before the workspace containment check, matching the behavior of search_files/apply_patch/edit.

Files to change

• internal/readfile/readfile.go
• internal/writefile/writefile.go
• internal/readfile/readfile_test.go
• internal/writefile/writefile_test.go

Related

PR #102 (Phase 2 OpenClaw/Hermes tool compatibility)

Start with internal/readfile/readfile.go and internal/writefile/writefile.go, then compare their relative-path handling with the newer file tools described in the issue. Update the corresponding readfile_test.go and writefile_test.go coverage so relative paths resolve from workspaceDir before containment validation, and run those tests to verify read and write aliases no longer reject valid workspace paths.