Unify shell auto-allow and path-restriction workspace containment

[TheGreatAxios]

Summary

Two permission checks disagreed on whether a path is "inside the workspace," so an identical request could get opposite verdicts.

• escapesWorkspace/argEscapesWorkspace (src/permission/classify.ts) — drives shell auto-allow eligibility — computed containment with a bare realpath-prefix check against a single cwd, with no knowledge of git worktrees.
• bindRestrictedToProcessCwd (src/permission/gate.ts:89-97), via createPathRestriction/resolveWorkspacePath in src/permission/path-restriction.ts, already resolved containment against cwd plus every registered git worktree root (via rootsProvider, backed by git worktree list).

A path inside a sibling worktree was auto-allow-eligible under one check and restricted under the other for the same argument.

Fix

escapesWorkspace now delegates to resolveWorkspacePath (src/permission/path-restriction.ts) instead of reimplementing prefix comparison. A RootsProvider (src/permission/worktree-roots.ts) is threaded through the call chain — isAutoAllowedShellCall → isAutoAllowedShellCommand/isAutoAllowedShellSegment → isAutoAllowedSegment → argEscapesWorkspace → escapesWorkspace — defaulting to a no-op () => [] roots list, so any caller that omits it (every existing test call site) keeps exactly today's cwd-only behavior. src/permission/gate.ts's two call sites now pass the gate's own rootsProvider — the same instance createPathRestriction already uses — so both checks always consult identical roots.

This builds on #386 (CL-5662), which added cwdMatchesGrant in src/permission/authz-grants.ts to resolve worktree membership for grant-cwd matching, but deliberately left classify.ts's containment logic unreconciled because the call shapes differ (per-shell-token containment vs per-request cwd identity). This PR completes that unification for the containment side: classify.ts now calls the one existing path-containment authority instead of reimplementing it.

Containment definitions remaining after this change: two, each owning a distinct question — resolveWorkspacePath/createPathRestriction (src/permission/path-restriction.ts) for "is this path argument inside the workspace," and cwdMatchesGrant (src/permission/authz-grants.ts) for "does this request's cwd match a stored grant's cwd." classify.ts contributes zero new definitions; it is now purely a caller of the first.

Security

This is a permission boundary. The unification cannot auto-allow anything the old split checks refused:

• Every caller of the shell auto-allow functions that doesn't pass a rootsProvider gets the NO_ROOTS = () => [] default, which reduces resolveWorkspacePath to the exact same real === realCwd || real.startsWith(realCwd + sep) check the old code did — identical result set.
• The only two callers that pass a real rootsProvider are gate.ts's own call sites, and they pass the identical instance already used to build the restriction check — never a broader one.
• Worktree membership is exact realpath equality against registered roots (never a path prefix), so a spoofing sibling directory (wt-1-evil next to wt-1) is still refused.

Tests

New file src/permission/workspace-containment.test.ts:

1. A path in a registered sibling worktree gets the same verdict (not restricted / auto-allowed) from both the auto-allow check and the restriction check — this is the disagreement CL-5671 reports; it failed before the fix and passes after.
2. A path genuinely outside the workspace and its worktrees is refused by both.
3. A prefix-spoofing sibling directory (wt-1-evil vs wt-1) is refused by both.
4. A symlink pointing outside the workspace is refused even for a not-yet-existing target under it — a narrower gap closed as a side effect of delegating to resolveWorkspacePath's nearest-existing-ancestor resolution.

Test plan

• bun run typecheck — clean
• bun run test (full suite via lock script) — 4143 pass, 0 fail
• bun run build — clean
• Reviewed by greybeard (approach, pre-code), critique, gaasbot, bruckheimer, neckbeard — all clean, critique explicitly verified no auto-allow widening for any existing caller

https://linear.app/abklabs/issue/CL-5671/shell-auto-allow-and-path-restriction-disagree-on-worktree-containment

[linear-code]

CL-5671