PT-2026-80311

The optional dashboard HTTP server atomic agents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.safe resolve under. Literal ../...