fix(scaffold-mcp): restrict write-to-file to workspace

[vuongngo]

Summary

• restrict \ targets to paths inside the current workspace
• reject absolute-path and relative-traversal escapes before creating directories or writing files
• add regression tests covering allowed in-workspace writes and blocked escape attempts

Testing

• pnpm --filter @agiflowai/scaffold-mcp test -- --run tests/tools/WriteToFileTool.test.ts
• pnpm --filter @agiflowai/scaffold-mcp typecheck
• git commit hook: nx run-many -t test

Closes #88