fix(security): guard cron script against path traversal and redact output

[memosr]

What does this PR do?

The new script field added in #5082 lets cron jobs run a Python script
before each turn to collect context data. Two security issues were introduced:

1. Path Traversal

Relative script paths were resolved against HERMES_HOME/scripts/ but
without checking that the resolved path stays inside that directory:

# Before (vulnerable)
path = get_hermes_home() / "scripts" / path

A job with script: "../../.hermes/auth.json" would resolve to the auth
store and attempt to execute it as Python — leaking its path in the error
message, or worse if the file happened to be valid Python.

Fix: After resolving the path, verify it stays within scripts_dir
using Path.relative_to(). Paths that escape the directory are rejected
with a clear error message.

# After (safe)
scripts_dir = get_hermes_home() / "scripts"
path = (scripts_dir / path).resolve()
try:
    path.relative_to(scripts_dir.resolve())
except ValueError:
    return False, f"Script path escapes the scripts directory: {script_path!r}"

2. Secret Leakage via Script Output

Script stdout is injected directly into the cron job's LLM prompt context
without redaction. If a script outputs environment variables, config values,
or any string matching a known secret pattern, those secrets flow into the
LLM context unmasked.

Fix: Apply redact_sensitive_text() to stdout before injecting it —
the same function already used for execute_code sandbox output and log
redaction.

from agent.redact import redact_sensitive_text
stdout = redact_sensitive_text(stdout)

3. Absolute Path Restriction (follow-up commit)

The initial fix only guarded relative paths. Absolute paths like
/tmp/evil.py or /etc/passwd were still accepted.

Fix: Absolute paths are now also restricted — they must resolve
inside HERMES_HOME. Paths outside are rejected with a clear error.

path.relative_to(get_hermes_home().resolve())

Type of Change

• 🔒 Security fix (path traversal)
• 🔒 Security fix (secret leakage)

Checklist

• Read the Contributing Guide
• Commit messages follow Conventional Commits
• Consistent with existing path validation pattern (Path.relative_to())
• Consistent with existing redaction pattern (execute_code sandbox)
• No behavior change for legitimate scripts in HERMES_HOME/scripts/

[teknium1]

Merged via PR #5147. Your path traversal guard and secret redaction fixes were cherry-picked onto current main with your authorship preserved. The absolute path restriction to HERMES_HOME was dropped as too restrictive for the feature's design intent — users may legitimately point cron scripts at paths outside ~/.hermes/. Thanks for the contribution!