fix: confine MCP agents' files to allowed folders; recovery discard deletes only recovery entries (#205) (#578)

Agent tool calls (MCP, and bridged control requests carrying allow_paths) reach files only in the open design's folder (strictly inside home or the temporary folder, not in a hidden folder, and never its hidden files), the app's recovery folder, the server's private scratch folder and each --allow-path; --allow-any-path lifts the limit. Paths are resolved first, so .. and symlinks that lead out (including a save through a link, #845) are refused. On Windows, UNC, device, NT, verbatim non-drive, drive-relative, alternate-stream, reserved-device and 8.3 short-name paths are refused before any file system call, and the resolved path must be on a local drive. doc.recovery_discard and doc.recover {discard} delete only real recovery entries. Docs: mcp.md, control-protocol.md, README.

crates/io/src/safe_write.rs

@@ -117,7 +117,9 @@ fn write_steps(path: &Path, bytes: &[u8], backup: bool, stop: Option<Step>) -> s
 
 /// Write `bytes` to `path` atomically; with `backup`, the file being replaced is kept as
 /// `<path>.bak` first. A symbolic link at `path` is followed (the file it points to is replaced,
-/// the link stays), and the file keeps the permissions it had.
+/// the link stays), and the file keeps the permissions it had. The app's own folders (autosave,
+/// crash reports) write through this without a [`crate::vfs::PathScope`]; a command writing a
+/// path it was given calls [`crate::vfs::check`] first, which judges where the link leads.
 pub fn write_atomic(path: &Path, bytes: &[u8], backup: bool) -> std::io::Result<()> {
     // In the browser the host stores files (one write is already atomic there).
     if cfg!(target_arch = "wasm32") {