Contain filesystem access at the provider boundary

[taras]

Story

As an XMD user, I want filesystem authorization that remains valid at the instant of access, so a concurrent path replacement cannot escape the root granted by the active filesystem provider.

Two provider contracts

xmd workflow and xmd run do not share one implementation guarantee:

• Under xmd workflow, declarative filesystem operations resolve logical paths inside the retained DOFS Workspace. The provider authorizes every operation against that logical namespace; it does not translate a validated path into an unguarded host filesystem access.
• Under xmd run, host filesystem providers must close the validate-then-use race for Deno, Node, Bun, and the compiled binary, or state a narrower supported guarantee explicitly.

Agent read-only materialization is owned by #302. It must not be used to claim that the ordinary host filesystem provider solved this race.

Acceptance

• architecture.md and the executable-MDX threat model distinguish the retained Workspace guarantee from each host-runtime guarantee.
• Workflow filesystem operations cannot escape through host symlink replacement because their authoritative namespace is provider-owned.
• The selected host mechanism and exact guarantee are stated for Deno, Node, Bun, and the compiled binary.
• A runtime that cannot provide the strong guarantee fails or documents its narrower boundary; XMD does not overclaim portability.
• Tests race a path replacement between authorization and access for every supported host implementation.
• Contextual APIs carry the operation; shared production modules do not detect runtimes.

Out of scope

• Agent-generated XMD and Agent provider sandboxing.
• Changing File authoring forms or exact-content behavior.
• Native command containment.

Dependencies

• PR 📝 Specify retained workflow Workspaces #358 supplies the retained Workspace provider boundary.
• Enforce read-only workflow Agent authority #302 consumes the resulting read-only materialization guarantee.
• End goal: Document adversarial implementation workflow WIP #181.