feat: add file-path scoping to restrict agent write access

[geoffjay]

feat: add file-path scoping to restrict agent write access

feat(orchestrator): add file-path scoping to agent tool policies

Extend ToolPolicy to enforce file-path restrictions per agent type so
that specialist agents cannot write outside their designated scope.

Orchestrator changes (types.rs)

• Extend match_tool to check the file_path input field (in addition
  to command) when evaluating parenthesized patterns for file tools
  (Write, Edit, Read, MultiEdit, NotebookEdit)
• Add match_path_pattern + match_path_segments + match_path_segment
  helpers that implement glob matching with * (single segment) and **
  (zero-or-more segments) for file paths
• Add 7 unit tests for match_path_pattern and 3 integration tests
  demonstrating deny_list and allow_list policies with path patterns

Agent YAML changes

Agent	Policy	Scope
tester	allow_list	crates/*/tests/, .github/workflows/, reads
documenter	deny_list	denies Write/Edit to crates//*.rs, .agentd/
designer	deny_list	denies Write/Edit to crates/, docs/, .agentd/**, CLAUDE.md
security	deny_list	denies Write/Edit to crates/, ui/, .agentd/, docs/
refactor	deny_list	denies Write/Edit to .agentd/, ui/, docs/**, CLAUDE.md
conductor	deny_list	denies Write/Edit to crates/, ui/, docs/, .agentd/, CLAUDE.md

Closes #642

[geoffjay]

This change is part of the following stack:

• feat: add file-path scoping to restrict agent write access #706 ◀

_{Change managed by git-spice.}