fix(agent-context): validate JARVOS_SECONDBRAIN_DIR before loading modules

[levineam]

Motivation

• The code previously trusted JARVOS_SECONDBRAIN_DIR (after only tilde expansion) and passed it into require() calls, creating a module-loading trust boundary that can lead to arbitrary JavaScript execution if the env var points at an attacker-controlled tree.
• Harden directory selection so MCP note creation cannot be made to execute untrusted module top-level code.

Description

• Replaced the previous secondbrainDir() short-circuit with logic that requires an absolute path (path.isAbsolute) and canonicalizes it with fs.realpathSync before use.
• Added existence and ancestry checks that walk the directory tree from the resolved candidate and reject roots that are not directories, not owned by the current user (or root), or that are group/world-writable ((stat.mode & 0o022) !== 0).
• Loaders (loadJarvosPaths, loadNoteWriter, loadJournalLinker, etc.) continue to call secondbrainDir() but now receive a validated canonical path, preventing pre-require() execution of untrusted code.
• Added a regression test createNote rejects an untrusted secondbrain module root before loading code in modules/jarvos-agent-context/test/agent-context.test.js that asserts a relative/attacker-controlled JARVOS_SECONDBRAIN_DIR is rejected before any module is loaded.

Testing

• Ran npm test in modules/jarvos-agent-context and the full test suite passed successfully.
• The suite reports all tests passing (54 tests, 0 failures), including the new regression test.

---

Codex Task