fix(agentcompat): secure legacy file manager boundaries

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/scenario/legacy_fm_verification.go

@@ -133,9 +133,9 @@ func newLegacyFMRunID() (string, error) {
 	return hex.EncodeToString(bytes), nil
 }
 
-func verifyLegacyFMSentinels(sentinelPaths []string, sentinel []byte) error {
-	for _, path := range sentinelPaths {
-		content, err := os.ReadFile(path)
+func verifyLegacyFMSentinels(root *os.Root, sentinelNames []string, sentinel []byte) error {
+	for _, name := range sentinelNames {
+		content, err := root.ReadFile(name)
 		if err != nil {
 			return err
 		}