KC-1430: Deny host-path I/O in Service Mode

[amangalampalli-ks]

Summary

Closed multiple command-execution bypasses in Service Mode that allowed host file read/writes through abbreviation tricks and temp directory confusion.

Changes

• Abbreviations like --out now correctly expand and get blocked as --output when needed.
• Each request gets its own private temp folder instead of trusting the whole /tmp directory.
• Import command now understands which formats need files (JSON, CSV) versus which don't (LastPass, Cyberark).
• Commands resolved through real parser instead of text scanning, closing bare-filename bypasses.
• Service Mode now logs all blocked commands for audit trails.
• New tests verify all exploits are closed and legitimate flows still work.