fix: resolve relative paths correctly in exec tool safety guard

Previously, relative paths in shell commands were resolved using the process's current working directory instead of the command's intended working directory. This caused legitimate relative paths (e.g., skills/file.md) to be evaluated as absolute paths from the process root, triggering false-positive safety blocks.

The guardCommand method now correctly distinguishes absolute and relative paths:
- Absolute paths are used as-is (cleaned)
- Relative paths are joined with the command's cwd before validation

This ensures relative paths are resolved relative to the intended working directory.

Closes #2749

pkg/tools/shell.go

@@ -1094,9 +1094,15 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 				}
 			}
 
-			p, err := filepath.Abs(raw)
-			if err != nil {
-				continue
+			// Resolve the path correctly based on cwd:
+			// - Absolute paths: use as-is (cleaned)
+			// - Relative paths: join with cwd to resolve correctly
+			var p string
+			if filepath.IsAbs(raw) {
+				p = filepath.Clean(raw)
+			} else {
+				p = filepath.Join(cwdPath, raw)
+				p = filepath.Clean(p)
 			}
 
 			if safePaths[p] {