Harden native Arbiter SSRF, redirects, and file containment

[tomvaillant]

Goal

Close the remaining security blockers from native Arbiter task #62.

Scope

• Reject all alternate numeric and untrusted DNS hosts before authenticated requests; use a strict trusted deployment policy or resolution/pinning that rejects private, loopback, link-local, reserved, and metadata targets.
• Revalidate redirect origin, scheme, and /api/v1 path before forwarding Authorization.
• Replace pathname check-then-use research I/O with descriptor-anchored no-follow operations for reads, writes, and atomic replacement; cover case/research directory swaps.
• Preserve plugin parity and existing native workflow behavior.

Acceptance

• Numeric, DNS-alias, private, redirect, and path-boundary hostile tests pass.
• Symlink/rename race tests prove reads and writes remain inside the case research root.
• No key material is logged, exposed, or fetched from the Navigator CLI.
• Focused tests, full Spotlight gate, independent review, and security audit pass.

Non-goals

• No real Arbiter study creation.
• No Data Navigator retirement in this task.