fix: reject absolute paths in ApplyPatch diffs

[juliuss007]

Summary

• Reject absolute diff header paths before resolving ApplyPatch targets.
• Validate resolved patch paths stay under the current workspace for both ApplyPatch implementations.
• Add regression tests covering absolute new-file patch paths.

Fixes PlatformNetwork/bounty-challenge#50105

Verification

• cargo +1.91.1 fmt --package cortex-engine --check
• git diff --check
• cargo +1.91.1 test -p cortex-engine absolute_new_file_path
• cargo +1.91.1 test -p cortex-engine apply_patch
• cargo +1.91.1 check -p cortex-engine

Bounty claim: PlatformNetwork/bounty-challenge#50105