Artifact publish can now source files from the scratchpad

What

• Sources for the artifact publish tool's files parameter (and the root it's relative to) can now live in the session's scratchpad directory, not only the current working directory — the tool's parameter descriptions were updated to say so explicitly.
• The underlying trust check for the root parameter was reworked: instead of a manual string-prefix comparison against the working directory, it now calls a new helper pair to validate the path, and file-processing calls (both the general file-copy path and thumbnail generation) pass an extra options object from a new helper function.

Why

This lets Claude publish artifacts built from files it created in its scratchpad, not just files in the project's working directory, while keeping the same path-trust safety checks, now reworked to also cover the scratchpad case.