fix(network-agent): allow single dots in sandboxID, only reject path traversal

The previous validation rejected any sandboxID containing a dot character,
which would block legitimate IDs. Now only reject empty strings, path
separators, and path-traversal sequences ("..").

Author: rogeroger-yu

network-agent/internal/service/state_store.go

@@ -92,7 +92,7 @@ func (s *stateStore) LoadAll() ([]*persistedState, error) {
 }
 
 func (s *stateStore) path(sandboxID string) (string, error) {
-	if strings.ContainsAny(sandboxID, `/\.`) || sandboxID == "" {
+	if sandboxID == "" || strings.ContainsAny(sandboxID, `/\`) || strings.Contains(sandboxID, "..") {
 		return "", fmt.Errorf("invalid sandboxID %q: contains path separators or traversal characters", sandboxID)
 	}
 	return filepath.Join(s.dir, sandboxID+".json"), nil