Fix structured IPC envelope leakage

Normalize EJClaw structured send_message envelopes, preserve attachments, unwrap stored room payloads, and add regression tests.

src/outbound-attachments.ts

@@ -21,6 +21,7 @@ const DEFAULT_TEMP_ATTACHMENT_DIR_PREFIXES = [
   'ejclaw-attachment-',
   'ejclaw-discord-image-',
 ] as const;
+const DEFAULT_TEMP_ATTACHMENT_FILE_PREFIXES = ['ejclaw-'] as const;
 
 function unique(values: Array<string | null | undefined>): string[] {
   return [
@@ -83,6 +84,21 @@ function isWithinDefaultTempAttachmentDir(
   );
 }
 
+function isDefaultTempAttachmentFile(
+  realPath: string,
+  tempDir: string | null,
+): boolean {
+  if (!tempDir) return false;
+  const relative = path.relative(tempDir, realPath);
+  if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+    return false;
+  }
+  if (relative.includes(path.sep)) return false;
+  return DEFAULT_TEMP_ATTACHMENT_FILE_PREFIXES.some((prefix) =>
+    relative.startsWith(prefix),
+  );
+}
+
 function detectImageMime(filePath: string): string | null {
   const handle = fs.openSync(filePath, 'r');
   try {
@@ -171,7 +187,8 @@ export function validateOutboundAttachments(
       }
       if (
         !matchesAllowedBaseDir(realPath, baseDirs) &&
-        !isWithinDefaultTempAttachmentDir(realPath, defaultTempDir)
+        !isWithinDefaultTempAttachmentDir(realPath, defaultTempDir) &&
+        !isDefaultTempAttachmentFile(realPath, defaultTempDir)
       ) {
         rejected.push({ path: requestedPath, reason: 'outside-allowed-dirs' });
         continue;