feat(service): auto-inject WORK_DIR and resolve file-type params in task script rendering

- ProcessTask injects $WORK_DIR only when script template uses it

- File/directory type params: resolves file_id to filename before rendering

- ValidateParams validates file/directory params as valid int64 file IDs

- RenderScript no longer shell-escapes file/directory type values

- Log rendered script before submitting to Slurm for debugging

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

internal/service/task_service.go

@@ -261,8 +261,61 @@ func (s *TaskService) ProcessTask(ctx context.Context, taskID int64) error {
 		return fail(model.TaskStepSubmitting, err.Error())
 	}
 
+	if strings.Contains(app.ScriptTemplate, "$WORK_DIR") {
+		values["WORK_DIR"] = workDir
+	}
+
+	// Resolve file-type parameters: user sends file_id, we replace with filename.
+	// Only query the database if there are file/directory-type parameters with values.
+	var fileLookupIDs []int64
+	for _, p := range params {
+		if p.Type != model.ParamTypeFile && p.Type != model.ParamTypeDirectory {
+			continue
+		}
+		val, ok := values[p.Name]
+		if !ok || val == "" {
+			continue
+		}
+		fileID, err := strconv.ParseInt(val, 10, 64)
+		if err != nil {
+			return fail(model.TaskStepSubmitting, fmt.Sprintf("parameter %q: invalid file_id %q, expected numeric file ID", p.Name, val))
+		}
+		fileLookupIDs = append(fileLookupIDs, fileID)
+	}
+
+	if len(fileLookupIDs) > 0 && s.fileStore != nil {
+		fetchedFiles, err := s.fileStore.GetByIDs(ctx, fileLookupIDs)
+		if err != nil {
+			return fail(model.TaskStepSubmitting, fmt.Sprintf("fetch file names for parameter resolution: %v", err))
+		}
+		fileMap := make(map[int64]string, len(fetchedFiles))
+		for _, f := range fetchedFiles {
+			fileMap[f.ID] = f.Name
+		}
+		for _, p := range params {
+			if p.Type != model.ParamTypeFile && p.Type != model.ParamTypeDirectory {
+				continue
+			}
+			val, ok := values[p.Name]
+			if !ok || val == "" {
+				continue
+			}
+			fileID, _ := strconv.ParseInt(val, 10, 64)
+			filename, found := fileMap[fileID]
+			if !found {
+				return fail(model.TaskStepSubmitting, fmt.Sprintf("parameter %q: file_id %d not found", p.Name, fileID))
+			}
+			values[p.Name] = filename
+		}
+	}
+
 	// 17. Render script
 	rendered := RenderScript(app.ScriptTemplate, params, values)
+	s.logger.Info("rendered script",
+		zap.Int64("task_id", taskID),
+		zap.String("work_dir", workDir),
+		zap.String("script", rendered),
+	)
 
 	// 18. Submit to Slurm
 	jobResp, err := s.jobSvc.SubmitJob(ctx, &model.SubmitJobRequest{