[TEST] Validate opensre ask context-file scenarios

Goal

Validate the new repeatable context-file support from #6318 across realistic CLI, file-system, safety, resume, and packaging scenarios before expanding the feature further.

Example

uv run opensre ask "Investigate checkout latency"       -i alert.txt       --context-file deployment.json

The operator instruction should remain first, both files should be attached in argument order as JSON-framed untrusted data, and normal ask behavior should remain unchanged.

Test matrix

Normal use

• One file with -i
• Multiple files mixing -i and --context-file
• Relative and absolute paths
• Filenames containing spaces and Unicode
• Common UTF-8 inputs: logs, JSON, YAML, Markdown, and plain text
• Attachment order is preserved
• Running without context files behaves exactly as before

Validation and limits

• Missing and unreadable files return clear errors
• Empty, invalid UTF-8, NUL-containing, and non-regular files are rejected
• Per-file 64 KiB limit is enforced
• Combined 128 KiB raw and JSON-encoded limits are enforced
• More than 16 attachments is rejected
• Files that grow or are replaced while opening remain safely bounded
• Symlink behavior is documented and tested on supported platforms

Prompt safety

• Operator instruction appears before all attached data
• JSON escaping preserves quotes, control characters, and delimiter-like text
• File content containing prompt-injection instructions remains marked as untrusted data
• Unusual filesystem paths render without breaking UTF-8 output

Session behavior

• New ask sessions receive attached context
• Resumed sessions receive context on a normal follow-up
• A pending-choice answer rejects simultaneous attachments without consuming the choice
• The user can answer the pending choice and attach files on the following turn

Distribution and platforms

• CLI help documents the repeatable option
• Editable checkout and packaged binary accept the same flags
• Smoke test Linux, macOS, and Windows path behavior
• Record one manual configured-provider run with redacted input/output

Success criteria

• Results for each applicable scenario are recorded in this issue.
• Any failure has a minimal reproduction and a linked follow-up issue.
• Automated tests cover every confirmed regression.
• The final manual smoke command and redacted output are attached here.

Related: #6072, #6317, #6318