Greptile Summary

Fixed mkdirp operations failing within workspace boundaries by switching directory validation from openBoundaryFile() to resolveBoundaryPath().

• Previously assertPathSafety tried to open directories as files using openBoundaryFile(), which failed for non-existent directories
• Now uses resolveBoundaryPath() for directory operations, which validates boundaries without attempting file operations
• Added guard to prevent creating directories at paths where files already exist
• Maintains all boundary and security checks while allowing legitimate mkdirp operations
• Tests verify in-boundary operations succeed and out-of-boundary operations are properly rejected

Confidence Score: 5/5

• This PR is safe to merge with no identified risks
• The fix is well-targeted and correct - it addresses the root cause by using the appropriate validation function for directory operations. The implementation maintains all security boundaries while fixing the legitimate use case. Comprehensive test coverage validates both success and failure paths.
• No files require special attention

_{Last reviewed commit: c777f4a}

Thanks for the PR! Multiple PRs address the same sandbox mkdirp safety check (#28863, #30521, #31478). Keeping #30521. Closing this one to reduce noise. This is an AI-assisted triage review. If we got this wrong, feel free to reopen or start a new PR — happy to revisit.