Retain issue roots in explicit workspaceWrite policies

[danielmcauley]

Context

Ensure explicit workspaceWrite sandbox policies keep the current issue workspace writable while still allowing extra writable roots like linked-worktree .git metadata.

TL;DR

Keep the issue workspace in explicit workspaceWrite roots and update the launcher follow-up contract.

Summary

• prepend the current issue workspace to explicit workspaceWrite policies at runtime
• keep non-workspaceWrite sandbox policies unchanged
• update config, app-server, and runtime tests for the new contract
• document the behavior in the Symphony README and SPEC

Alternatives

• keep passing explicit policies through unchanged, but that forces callers to grant broad workspace roots
• rely on cwd being writable implicitly, but current runtime/tests model explicit writableRoots as authoritative

Test Plan

• make -C elixir all
• cd /Users/dtm/code/symphony/elixir && mise exec -- mix test test/symphony_elixir/app_server_test.exs test/symphony_elixir/workspace_and_config_test.exs test/symphony_elixir/core_test.exs
• cd /Users/dtm/code/symphony/elixir && mise exec -- mix specs.check

[airhorns]

I hit this issue as well and an agent made a similar fix

[gpt-cmdr]

LGTM — dual-approved, merging.