Fix: make artifact filename rooting host-OS independent in FileArtifactService

[AmaadMartin]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):
   N/A
2. Or, if no issue exists, describe the change:
   Problem: getArtifactDir rejects absolute artifact filenames with path.isAbsolute, which follows the host platform. On POSIX it reads C:\evil.txt and \evil.txt as ordinary relative names, so one filename is an error on Windows and a valid artifact on Linux. It also leaves backslashes intact, so sub\file.txt becomes a single directory whose name contains a backslash instead of nesting under sub/. An artifact store written on one operating system does not read back the same way on another.

Solution: Parse the filename with path.win32, which reports a non-empty root for a drive, the drive-relative C:, a UNC share, a leading backslash and a leading / on every platform. Rewrite backslashes to / before resolving, so sub\file.txt nests exactly like sub/file.txt and sub\..\..\escape.txt reaches the existing containment check. This mirrors PureWindowsPath(...).drive or .root in adk-python. The public API, the two error messages and the containment check are unchanged.

Notes:

• One behaviour narrowing. A filename such as a:b.txt is now rejected on POSIX, because path.win32 reads a: as a drive. adk-python rejects it identically, and no fixture or sample in this repo uses such a name.
• Why not asPosixPath. It splits on path.sep, so it is a no-op for backslashes on POSIX. It is left alone, and the filename uses replaceAll('\\', '/') inline, the idiom already used in dev/src/conformance.
• Collision check. I checked the 300 open pull requests on this fork. No branch touches the rooting guard in core/src/artifacts/file_artifact_service.ts. Fix: consolidate path containment into one shared helper and stop over-rejecting '..'-prefixed artifact filenames #658 and Fix: stop rejecting every child when the containment base is the filesystem root (stacked on #658) #676 rewrite the containment check on the lines just below it; that work is independent, so this branch starts from main and keeps the containment predicate as it is.

Testing Plan

Please describe the tests that you ran to verify your changes. This is required for all PRs that are not small documentation or typo fixes.

Unit Tests:
[x] I have added or updated unit tests for my change.
[x] All unit tests pass locally.

Six tests were added to core/test/artifacts/file_artifact_service_test.ts. No existing test was changed.

npx vitest run --project unit:core core/test/artifacts/file_artifact_service_test.ts
  Test Files  1 passed (1)
       Tests  48 passed (48)
npm run lint          # exit 0
npx prettier --check core/src/artifacts/file_artifact_service.ts core/test/artifacts/file_artifact_service_test.ts   # clean
npm run ts:check      # 280 errors, all pre-existing; identical count on main, none in these two files

New lines reach 100% line and branch coverage, measured with
--coverage.include='core/src/artifacts/file_artifact_service.ts'.

Proof the tests can fail. I ran each new test against the unfixed code.

1. Restore if (path.isAbsolute(cleanFilename)) — 3 tests fail. The two drive
   forms report promise resolved "+0" instead of rejecting. The
   \evil.txt case reports expected [Function] to throw error including 'Absolute artifact filename \evil.txt …' but got 'Artifact filename \evil.txt escapes s…'.
2. Delete cleanFilename = cleanFilename.replaceAll('\\', '/'); — 2 tests fail.
   nests a filename that uses Windows separators reports promise rejected "Error: ENOENT: no such file or directory…" instead of resolving.
   rejects nested traversal expressed with Windows separators reports
   promise resolved "+0" instead of rejecting.
3. rejects traversal expressed with Windows separators (..\escape.txt)
   survives both mutations. path.relative returns the literal name
   ..\escape.txt, which starts with .., so today the containment check
   rejects it by coincidence. I kept the test as a regression pin, because the
   coincidence disappears if the containment check becomes segment-wise.

CI passes on ubuntu-latest, windows-latest and macos-latest. The first two
runs failed on the known app_loader discovery timeout on macos-latest, which
#664 explains and fixes; fail-fast then cancelled the Windows leg. A rerun of
the same commit is green on all three.

Manual End-to-End (E2E) Tests:
Please provide instructions on how to manually test your changes, including any necessary setup or configuration.

Run this on Linux or macOS after npm install && npm run build:

import {FileArtifactService} from '@google/adk';
import * as fs from 'node:fs/promises';
import * as os from 'node:os';
import * as path from 'node:path';

const root = await fs.mkdtemp(path.join(os.tmpdir(), 'adk-e2e-'));
const service = new FileArtifactService(root);
const base = {appName: 'app', userId: 'u', sessionId: 's'};

// Before: succeeds on POSIX. After: throws.
await service.saveArtifact({
  ...base,
  filename: 'C:\\evil.txt',
  artifact: {text: 'x'},
});

// Before: one directory named "sub\file.txt". After: nests under sub/.
await service.saveArtifact({
  ...base,
  filename: 'sub\\file.txt',
  artifact: {text: 'hello'},
});

Observed on Node v22.22.2:

Absolute artifact filename C:\evil.txt is not permitted.
<root>/users/u/sessions/s/artifacts/sub/file.txt/versions/0/file.txt
<root>/users/u/sessions/s/artifacts/sub/file.txt/versions/0/metadata.json
loadArtifact('sub\file.txt') -> {text: 'hello'}
entries containing a backslash: 0

Checklist

[x] I have read the CONTRIBUTING.md document.
[x] I have performed a self-review of my own code.
[x] I have commented my code, particularly in hard-to-understand areas.
[x] I have added tests that prove my fix is effective or that my feature works.
[x] New and existing unit tests pass locally with my changes.