Define containment for project Agent source mutations

**Describe the bug**

Project-scoped Agent create and import operations use lexical project paths and ordinary filesystem writes. If a project-controlled Agent root or one of its ancestors is a link, creation can leave the selected project boundary.

This mutation surface is currently unused by the desktop client, so the product must decide whether to retain it before adding a substantial cross-platform filesystem containment subsystem.

---

**To Reproduce**

1. Open a project whose Agent source root resolves through a link.
2. Invoke project-scoped Agent create or import through the ACP source API.
3. Observe that the filesystem operation follows the linked root.

---

**Expected behavior**

Either remove the unused project Agent mutation surface, or define a containment contract that prevents any externally visible write outside the selected project, including during concurrent ancestor renames.

---

**Screenshots**

Not applicable.

---

**Please provide the following information**

- **OS & Arch:** Cross-platform filesystem behavior
- **Interface:** ACP source API
- **Version:** current `main`
- **Extensions enabled:** Not applicable
- **Provider & Model:** Not applicable

---

**Additional context**

The design should choose one of these directions:

- remove project-scoped Agent create/import if the surface is not supported; or
- retain it with an explicit Unix symlink and Windows reparse-point/junction contract, root-anchored operations, and a concurrent-rename invariant.

The verification plan should cover linked roots and ancestors, create and import, collision naming, regular project behavior, Windows reparse points, and a race proving no out-of-project file becomes visible.

Do not begin implementation until this issue reaches **Ready** on the [Goose Issues board](https://github.com/orgs/aaif-goose/projects/1).

The issue describes a potential security boundary violation in project-scoped Agent source mutations when roots or ancestors are symbolic links. The ACP source API is the entry point. Research the current implementation of Agent create and import operations, focusing on how project paths are resolved and filesystem writes are performed. The goal is to define a containment contract or recommend removing the feature, requiring a deep understanding of cross-platform filesystem behavior and concurrent operations.

由索引模型根据 Issue 内容生成。