- ProcessTask injects $WORK_DIR only when script template uses it
- File/directory type params: resolves file_id to filename before rendering
- ValidateParams validates file/directory params as valid int64 file IDs
- RenderScript no longer shell-escapes file/directory type values
- Log rendered script before submitting to Slurm for debugging
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>