Fix runtime image attachment paths

Allow nested /tmp generated images and per-room runtime workspace attachments after realpath/image validation.

src/ipc-outbound-delivery.test.ts

@@ -94,7 +94,10 @@ describe('deliverIpcOutboundMessage', () => {
       expect.objectContaining({
         channel,
         item: createdItem,
-        attachmentBaseDirs: ['/repo'],
+        attachmentBaseDirs: expect.arrayContaining([
+          '/repo',
+          expect.stringMatching(/data\/workspaces\/room-folder$/),
+        ]),
       }),
     );
     expect(channel.sendMessage).not.toHaveBeenCalled();
@@ -144,7 +147,10 @@ describe('deliverIpcOutboundMessage', () => {
       expect.objectContaining({
         channel: reviewerChannel,
         item: createdItem,
-        attachmentBaseDirs: ['/repo'],
+        attachmentBaseDirs: expect.arrayContaining([
+          '/repo',
+          expect.stringMatching(/data\/workspaces\/room-folder$/),
+        ]),
       }),
     );
     expect(noteDirectTerminalDelivery).toHaveBeenCalledWith(