Pi 0.11.7

Fixed

• Fix read path traversal vulnerability. Paths are now validated to prevent reading outside the working directory or its parents. The read tool can read from cwd, its ancestors (for config files), and all descendants. Symlinks are resolved before validation.