consume only artifacts the runtime produced

tile_manifest_path arrives in the detection and segmentation request and was
read straight off disk, and a manifest entry may name an absolute tile path.
That makes an API field an unbounded reference to the host filesystem, and it
contradicts the rule the persistence model rests on: only a governed,
runtime-produced artifact may be consumed, and a file outside the storage root
is not one.

Both the manifest and every tile it names now resolve under STORAGE_ROOT.
Resolution happens before the comparison, so ".." cannot climb out and a
sibling that merely shares a name prefix does not pass.
GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS opts out for provisioning workflows that
stage tiles before ingest.

The check honours the Settings the caller is operating under rather than the
process-wide ones, because every analysis path already threads its own.

The affected tests write manifests into tmp_path, so they now declare tmp_path
as the storage root — which is what a deployment does, and makes the fixtures
more honest than they were.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/API_CONTRACTS.md

@@ -1715,6 +1715,14 @@ reproducibility. Clients must not submit arbitrary model paths.
 
 GeoIntel does not download model weights automatically. Configured YOLO runs read existing tile files from the manifest, convert YOLO pixel-space boxes to EPSG:4326 detection polygons and persist detections as first-class records.
 
+The manifest path, and every tile path inside it, must resolve under
+`STORAGE_ROOT`. The path arrives in the request and a manifest entry may name an
+absolute tile path, so without that check the field is an unbounded reference to
+the host filesystem — and a file outside the root is by definition not the
+governed, runtime-produced artifact the persistence model requires. Rejection is
+`STORAGE_PATH_OUTSIDE_ROOT`; `GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS` opts out
+for provisioning workflows that stage tiles before ingest.
+
 The manifest must carry explicit CRS metadata (`crs`, `source_crs` or
 `dataset_crs`). A manifest without it fails with
 `DETECTION_TILE_MANIFEST_INVALID` rather than being georeferenced against an