fix: resolve relative paths against CWD when parentDir is empty

[dgageot]

Summary

When agent configs are loaded from OCI/URL/bytes sources, parentDir is empty. Previously, GetAbsolutePaths, makeAbsolute, and ResolveDatabasePath would produce broken relative paths via filepath.Join("", path). Now they fall back to filepath.Abs() which correctly resolves against the current working directory.

Changes

• pkg/rag/manager.go — GetAbsolutePaths(): fall back to filepath.Abs() when basePath is empty
• pkg/rag/strategy/helpers.go — makeAbsolute() and ResolveDatabasePath(): same fix
• Added debug logging to help diagnose path resolution issues
• Added tests for all three functions covering both empty and non-empty parent dir scenarios

Non-breaking

When parentDir is non-empty (normal file-source case), behavior is unchanged. The fix only affects OCI/URL/bytes sources where parentDir was previously empty.

Fixes #1655

[docker-agent]

Assessment: 🟡 NEEDS ATTENTION

Found 2 confirmed issues in the error handling logic for path resolution.

[docker-agent]

🟡 MEDIUM: Error handling violates function contract

When filepath.Abs(p) fails, the code falls back to appending the original relative path unchanged:

absPaths = append(absPaths, p)

This violates the function's contract — GetAbsolutePaths promises to return absolute paths, but can silently return relative paths when filepath.Abs fails. Downstream code expecting absolute paths may encounter file-not-found errors or incorrect path comparisons.

Recommendation: Return an error instead of silently degrading to relative paths, or document this fallback behavior explicitly in the function comment and ensure all callers handle it.

[docker-agent]

🟡 MEDIUM: Error handling violates function contract

When filepath.Abs(p) fails and parentDir is empty, the function returns the original relative path unchanged:

return p

This violates the function's contract — makeAbsolute promises to make paths absolute, but can silently return relative paths when filepath.Abs fails. This is inconsistent with ResolveDatabasePath (which returns an error on failure) and could mask real problems like filesystem permission issues.

Recommendation: Either return an error (matching ResolveDatabasePath behavior) or document this fallback behavior. Consider whether callers can safely handle relative paths.