CVE-2026-75914: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

image_analyze follows workspace symlinks and leaks outside-workspace file bytes to the vision endpoint

The image_analyze tool resolves its image_path with a bare context.workspace.join instead of routing through ToolContext::resolve_path. The pre-join lexical check rejects absolute paths, Windows prefixes, and parent-dir components but never canonicalizes, so a symlink inside the workspace whose name ends in an image extension and whose target sits outside the workspace is read transparently. The tool has ReadOnly capability and the trait default makes it auto-approved, so the bypass executes with no user prompt.