fix(tools): keep read-only roots out of write paths

[yu-xin-c]

Summary

• keep filesystem extra allowed roots read-only by applying them only to read/list tools
• stop write/edit tools from inheriting media-dir access under workspace restriction
• add regression coverage for extra allowed dirs and media dirs staying write-protected

Tests

• uv run --extra dev pytest tests/tools/test_filesystem_tools.py::TestWorkspaceRestriction tests/security/test_workspace_policy.py tests/security/test_workspace_sandbox.py tests/tools/test_message_tool.py -q
• uv run --extra dev pytest tests/tools/test_filesystem_tools.py tests/tools/test_sandbox.py tests/security/test_workspace_policy.py tests/security/test_workspace_sandbox.py -q
• uv run --extra dev ruff check nanobot/agent/tools/path_utils.py nanobot/agent/tools/filesystem.py tests/tools/test_filesystem_tools.py --select F

[yu-xin-c]

Closing this as superseded by the current main branch. The behavior this PR was preserving is already present upstream now: read-only extra allowed roots do not widen write/edit paths, media-dir access stays read-only by default, and explicit extra_write_allowed_dirs / extra_write_allowed_files cover write opt-ins. Keeping this PR open would only leave a conflicting duplicate with no useful remaining diff to replay.