fix: Prevent path injection in RL Job Summary UI

- Use _safe_resolve() for job_path validation (line 198)
- Fixes CodeQL py/path-injection warning (Alert #3)
- Consistent with FT UI fix (commit 2d48653f)

Security improvements:
- All user-provided paths now go through _safe_resolve()
- Path traversal sequences rejected before filesystem access
- Clear error message for invalid paths

Fixes GitHub Code Scanning Alert #3 (py/path-injection)

rdagent/app/rl/ui/app.py

@@ -195,7 +195,11 @@ def main():
 
     if view_mode == "Job Summary":
         st.title("📊 RL Job Summary")
-        job_path = Path(job_folder).resolve()
+        try:
+            job_path = _safe_resolve(job_folder, safe_root)
+        except ValueError as e:
+            st.warning(str(e))
+            return
         if job_path.exists():
             render_job_summary(job_path, is_root=is_root_job)
         else: