fix(permission): apply read filename deny rules consistently

[SergioChan]

Issue for this PR

Closes #16331

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

read permission checks were evaluating absolute paths, while typical deny rules for sensitive files are configured as relative filename patterns (for example appsettings.json, appsettings.*.json).

This caused a mismatch where .env* rules still matched but exact filename rules like appsettings.json could be bypassed.

This PR aligns read with other file tools by evaluating the path relative to the project worktree before permission matching.

It also extends read permission tests to cover appsettings.json and appsettings.Development.json as denied/ask-protected cases.

How did you verify your code works?

I added targeted test coverage in packages/opencode/test/tool/read.test.ts for appsettings.json patterns.

I could not run Bun tests in this environment because bun is not installed (bun: command not found).

Screenshots / recordings

N/A (non-UI change)

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• Not all checklist items are checked. Please confirm you have tested locally and have not included unrelated changes.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[SergioChan]

Follow-up on issue-compliance check: I can’t run Bun-based local tests in this environment because is not installed ().\n\nWhat I did verify:\n- Scope is minimal and issue-linked ()\n- Change is limited to permission filename deny-rule handling\n- No unrelated files were modified\n\nIf maintainers want, I can also push a small CI-only validation note in the PR body format they prefer.

[SergioChan]

Correction (previous comment had CLI quoting issues):

I can’t run Bun-based local tests in this environment because bun is not installed (/bin/bash: bun: command not found).

What I did verify:

• Scope is minimal and issue-linked (Closes #16380)
• Change is limited to permission filename deny-rule handling
• No unrelated files were modified

If maintainers prefer a different PR-template handling for constrained environments, I can adjust the PR body accordingly.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.