This PR fixes a local file access vulnerability where YAML path fields (e.g., cv.photo) could reference arbitrary absolute paths outside the input directory, leading to potential disclosure of sensitive files during rendering.

Key changes:

• The path resolution logic in resolve_relative_path now enforces that all resolved paths must be contained within the input YAML's directory. Absolute or escaping paths are rejected.
• Added a test (test_yaml_path_containment.py) to verify that paths outside the input directory are not allowed, and that valid relative paths within the directory are accepted.

Impact:

• This closes the vulnerability where a crafted YAML could cause the renderer to access or copy arbitrary files from the host system.
• The fix is enforced at the schema validation layer, so all downstream consumers are protected.