fix(security): disable Liquid template file access

[Thibault1818]

Summary

• disable LiquidJS filesystem access for ORCH prompt templates
• reject absolute, relative, dynamic, include, and render file references
• preserve normal in-memory variable and filter rendering

Threat

Prompt templates can be influenced by repository configuration. Liquid file-backed tags could read host files and place their contents into an agent prompt. The custom filesystem implementation fails closed so templates cannot access local files.

Test Plan

• npm ci --ignore-scripts
• npm test -- test/unit/infrastructure/template-engine.test.ts (41 passed)
• npm run typecheck
• npm test (127 files, 2095 passed, 2 skipped)
• npm run build
• npm audit (0 vulnerabilities)
• git diff --check

Limits

This PR only closes template filesystem access. It does not include the role workflow, adapter changes, package metadata, publishing changes, fork links, or generated dist files.

[oxgeneral]

Reviewed at f09c917. I found no blocking injection or security issue in this change.

The PR is correctly scoped and hardens the existing LiquidTemplateEngine instead of introducing a parallel rendering path. I verified that absolute, relative, dynamic, Windows-style, include, render, layout, and inline-Liquid file references fail closed. Context values are rendered once and are not reinterpreted as Liquid, and prototype properties such as constructor and __proto__ remain inaccessible.

This is safe to merge. A non-blocking improvement would be to add explicit regression cases for layout, inline-Liquid includes, and Windows paths to the committed test suite.

The repository should also run its real CI checks on this PR; currently GitHub only reports the welcome job.