Define containment for project Agent source mutations

**Describe the bug**

Project-scoped Agent create and import operations use lexical project paths and ordinary filesystem writes. If a project-controlled Agent root or one of its ancestors is a link, creation can leave the selected project boundary.

This mutation surface is currently unused by the desktop client, so the product must decide whether to retain it before adding a substantial cross-platform filesystem containment subsystem.

---

**To Reproduce**

1. Open a project whose Agent source root resolves through a link.
2. Invoke project-scoped Agent create or import through the ACP source API.
3. Observe that the filesystem operation follows the linked root.

---

**Expected behavior**

Either remove the unused project Agent mutation surface, or define a containment contract that prevents any externally visible write outside the selected project, including during concurrent ancestor renames.

---

**Screenshots**

Not applicable.

---

**Please provide the following information**

- **OS & Arch:** Cross-platform filesystem behavior
- **Interface:** ACP source API
- **Version:** current `main`
- **Extensions enabled:** Not applicable
- **Provider & Model:** Not applicable

---

**Additional context**

The design should choose one of these directions:

- remove project-scoped Agent create/import if the surface is not supported; or
- retain it with an explicit Unix symlink and Windows reparse-point/junction contract, root-anchored operations, and a concurrent-rename invariant.

The verification plan should cover linked roots and ancestors, create and import, collision naming, regular project behavior, Windows reparse points, and a race proving no out-of-project file becomes visible.

Do not begin implementation until this issue reaches **Ready** on the [Goose Issues board](https://github.com/orgs/aaif-goose/projects/1).