fix(hub): prevent project-context symlink exfiltration

[study8677]

Motivation

• _load_project_context previously used Path.is_file() and Path.read_text() which follow symlinks and can read files outside the workspace, allowing a malicious repo to cause exfiltration of host secrets into LLM prompts.
• The helper also read entire files before applying the character cap, increasing exposure for large symlink targets.

Description

• Hardened _load_project_context in engine/antigravity_engine/hub/ask_pipeline.py to resolve candidate paths and validate them with is_safe_path(workspace, resolved) before reading.
• Replaced full-file read_text() usage with a bounded reader resolved.open().read(limit) that only reads up to the current per-source/budget slice.
• Added a small helper def _read_project_doc(path: Path) -> str to centralize resolve/validate/bounded-read logic and silently skip unsafe or unreadable sources.
• Added regression test test_load_project_context_skips_symlink_outside_workspace in engine/tests/test_hub_pipeline.py to ensure symlinked project docs resolving outside the workspace are ignored.

Testing

• Ran pytest -q engine/tests/test_hub_pipeline.py -k project_context and the project-context-related tests passed (4 passed, 13 deselected) with only pytest mark warnings unrelated to the change.
• The new test test_load_project_context_skips_symlink_outside_workspace was executed and succeeded, verifying the symlink-exclusion behavior.

---

Codex Task