fix(vscode): validate webview openFile paths

[wuyua9]

Summary

• resolve semantic search webview openFile targets against the active workspace root before opening them
• reject empty, non-string, absolute, or .. paths that would leave the workspace
• keep normal in-workspace search results opening as before

Tests

• Built core declarations with ./node_modules/.bin/tsc -p packages/core/tsconfig.json
• Ran ./node_modules/.bin/tsc -p packages/vscode-extension/tsconfig.json --noEmit
• Ran a direct Node regression check for resolveWorkspaceFilePath covering normal paths, normalized in-workspace paths, ../ escapes, absolute paths, empty values, and non-string values

Note: local pnpm install --frozen-lockfile completed dependency extraction but exited on the local pnpm 11 ignored-build approval policy, so validation used the installed toolchain directly.