feat: workspace fence toggle (workspaceFence pref + one-click off in error surfaces)

- New persisted built-in pref workspaceFence (default true) under the
  files card's secondary settings modal; host reads it per request via
  the settings seam (fenceEnabledOf — absent/malformed stays ON).
- ensureWorkspacePath/ensureWorkspaceWritePath gain a fence param:
  disarmed skips the containment assert but keeps realpath resolution;
  wired through fs.tree/fs.read/fs.write, the media + html routes, and
  the upload path (writeWorkspaceUpload fence input).
- Editor load failures and file-tree level errors show the localized
  reason plus a one-click global off (FenceErrorNotice) that flips the
  pref, adopts it into the store, and auto-retries the failed operation
  (reloadSeq / retryDir) — the raw wire text is never shown.
- GitView's two client-side pre-checks (hidden open action + no-op
  defense) respect the pref; store threaded through TreePanel/FileTree.
- i18n: 4 new keys across all 21 dictionaries; tests: fence-off route
  coverage, prefs parsing, schema default, editor toggles list;
  docs: guide §8/§8.1 + plans/2026-08-29 design record.

src/prefs-shared.ts

@@ -77,6 +77,20 @@ export interface SidebarPrefs {
    * Side card settings; off restores the pre-merge editor exactly.
    */
   editorExplorer: boolean
+  /**
+   * Whether the sidebar's filesystem routes enforce the workspace fence:
+   * every client-supplied path must resolve (through symlinks) inside the
+   * session workspace, else the route answers 403 "outside workspace". On
+   * by default; turning it OFF lets the file tree / editor read+write /
+   * media / HTML preview / upload routes reach ANY host path (e.g. the
+   * global ~/.dsh/AGENTS.md or a linked worktree outside the session cwd)
+   * — the trade-off being that any same-origin script (including
+   * third-party consumer plugins) can read/write outside the workspace
+   * through those routes while it is off. The switch lives under the files
+   * tab's gear in the Side card settings; the fence error surfaces offer a
+   * one-click global off + retry.
+   */
+  workspaceFence: boolean
   /**
    * The shell the UI and agent terminals spawn (absolute path or bare
    * executable name). Empty (default) keeps the legacy resolution order:
@@ -253,6 +267,7 @@ export const SIDEBAR_PREFS_DEFAULTS: SidebarPrefs = {
   terminalFontSize: TERMINAL_FONT_SIZE_DEFAULT,
   interceptOpenPath: true,
   editorExplorer: false,
+  workspaceFence: true,
   terminalShell: '',
   terminalShellArgs: '',
   titleBarScheme: 'auto',