feat(security): 新增工具沙箱安全机制

为所有工具插件添加沙箱拦截层，防止危险的文件访问、Shell命令和Python代码执行。
包含配置文件、核心校验逻辑及31个单元测试。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kilostar/plugin/tool_plugin/file_reader/file_reader.py

@@ -47,6 +47,13 @@ async def file_reader(file_path: str) -> str:
     Returns:
         文件内容文本，若文件不存在则返回错误信息
     """
+    from kilostar.utils.sandbox import validate_path, PathViolation
+
+    try:
+        file_path = validate_path(file_path, write=False)
+    except PathViolation as e:
+        return f"[Sandbox] {e}"
+
     try:
         with open(file_path, "r", encoding="utf-8") as f:
             return f.read()