fix(permissions): stop decoy raw keys from shadowing real tool paths

[Mr-Neutr0n]

Fixes #348

Root cause

_resolve_permission_file_path in src/openharness/engine/query.py checked raw tool_input keys (file_path first) before the validated model, but execution runs on parsed_input only — tool.execute(parsed_input, ...). Since every built-in file tool's schema field is path (read_file, write_file, edit), a model-supplied file_path key is dropped by Pydantic as an unknown field while still winning the permission check. Deny rules evaluated the decoy; execution touched the real path.

The same raw-first pattern existed in _extract_permission_command.

Change

Both resolvers now treat validated model fields as authoritative and fall back to raw keys only for dynamic-schema tools (MCP proxies) whose parsed models expose no path/command attributes:

# parsed first — execution uses exactly these values
for attr in ("file_path", "path", "root"):
    value = getattr(parsed_input, attr, None)
    ...
# fallback for dynamic-schema tools
for key in ("file_path", "path", "root"):
    value = raw_input.get(key)

Verification

Engine-level regressions reproduce the issue PoC without any live model endpoint:

• read_file with {"file_path": "README.md", "path": "work/blocked/secret.txt"} under a deny rule → blocked (was: returned file contents)
• write_file with the same decoy pair under FULL_AUTO + deny rule → blocked, nothing written (was: wrote into denied path)
• Control cases preserved: no-decoy calls still deny; a real allowed path with a decoy pointing at a denied one still succeeds (no over-blocking)

pytest tests/test_engine/test_query_engine.py -k decoy        # 2 failed on vulnerable code -> 3 passed with fix
pytest tests/test_engine tests/test_permissions tests/test_tools  # 190 passed; identical 3 pre-existing env failures on clean main

---

This change was prepared with AI assistance under human direction and review.