This is very timely, Trent, as I'm just switching back into CodeRunner development mode, now that our teaching term has (almost) finished. I've got a list of things I want to do; file upload is on the list, near the top, so it should happen.
I think I'll just treat files uploaded by the students the same as support files included by the author. They just get copied into the working directory. Also, they're read only so they can't get changed when testing, which could introduce unwanted side-effects between tests.
I'll post back when it's done.