[Bug]: Out-of-workspace write hard-block is blind to kimi-code's Write tool — `_paths` extraction does not recognize kimi toolCall path fields

**Environment**: QwenPaw 2.2.0 (desktop, macOS arm64); kimi-code runner via ACP.

**Observed (live negative probe, 2026-09-12)**:

1. A delegated kimi-code ACP session was asked to write a probe file at `/tmp/kimi_oob_probe.txt` — outside the agent's workspace.
2. The write succeeded without triggering QwenPaw's out-of-bounds hard block and without a path-related permission prompt. (The file was verified to exist on disk afterwards.)
3. Inspection of the toolCall payload shows kimi-code's Write calls do not expose the target path in any of the fields QwenPaw's `_paths` extraction recognizes (`locations` / `diff` / `rawInput.path`). The path boundary check therefore sees an empty path set and has nothing to deny.

**Why this matters**: operators configuring ACP runners reasonably assume the workspace-boundary hard block applies uniformly to all runners' file-writing tools. For kimi-code it silently does not — the effective guard reduces to the catastrophic-shell-command regex plus whatever the runner itself enforces. This is a silent security-posture gap, not a usability issue.

**Suggested fix**:
1. Extend `_paths` extraction to also parse kimi-code's toolCall shapes — the path is available in `rawInput` (under tool-specific keys) and/or the human-readable `title` field; and/or
2. Fail-closed option: when a toolCall is known to be a file-write operation (by tool name/kind) but `_paths` extraction yields nothing, treat it as out-of-bounds or force an interactive confirmation rather than silently allowing.

**Minimal repro**:
1. Configure a kimi-code ACP runner (default policy, workspace boundary enabled).
2. Via `delegate_external_agent`, instruct the runner to create a file at an absolute path outside the workspace (e.g. `/tmp/probe.txt`) using its Write tool.
3. Expected: hard block (or at minimum an explicit out-of-bounds prompt). Actual: file is written with no boundary intervention.

Locate the out-of-workspace hard-block path in the code and the `_paths` extraction logic for toolCall payloads (`locations`, `diff`, `rawInput.path`) called out by this issue. Start by reading that parser and the write-tool routing path, then add support for kimi-code write payload shape or a fail-closed branch when a write tool yields no paths. Run the provided minimal repro via `delegate_external_agent` writing `/tmp/...` with Write and verify it now triggers a hard block or explicit prompt; a regression test for this payload shape is the done criterion.

Scritto dal modello di indicizzazione a partire dal testo della issue.