consume only artifacts the runtime produced

tile_manifest_path arrives in the detection and segmentation request and was
read straight off disk, and a manifest entry may name an absolute tile path.
That makes an API field an unbounded reference to the host filesystem, and it
contradicts the rule the persistence model rests on: only a governed,
runtime-produced artifact may be consumed, and a file outside the storage root
is not one.

Both the manifest and every tile it names now resolve under STORAGE_ROOT.
Resolution happens before the comparison, so ".." cannot climb out and a
sibling that merely shares a name prefix does not pass.
GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that
stage tiles before ingest.

The check honours the Settings the caller is operating under rather than the
process-wide ones, because every analysis path already threads its own.

The affected tests write manifests into tmp_path, so they now declare tmp_path
as the storage root — which is what a deployment does, and makes the fixtures
more honest than they were.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/test_model_asset_catalog.py

@@ -287,7 +287,10 @@ def test_model_assets_api_returns_canonical_envelope(monkeypatch, tmp_path: Path
     assert payload["data"]["items"][0]["will_download_models"] is False
 
 
-def test_detection_run_persists_selected_model_asset_parameters(tmp_path: Path) -> None:
+def test_detection_run_persists_selected_model_asset_parameters(tmp_path, monkeypatch: Path) -> None:
+    # A manifest written into tmp_path is only a governed artifact if
+    # tmp_path is the storage root.
+    monkeypatch.setenv("STORAGE_ROOT", str(tmp_path))
     model_file = tmp_path / "building-detector.pt"
     model_file.write_bytes(b"local model")
     db, project_id, dataset_id = _project_and_raster_dataset()