permissions.blockReadsOutsideWorkingDirectories ignores additionalDirectories from project and local settings

**Environment**
- Claude Code 2.1.263 (CLI and Claude desktop app 1.46388.4, macOS 25.6)

**Setup**
- User settings (`~/.claude/settings.json`): `permissions.blockReadsOutsideWorkingDirectories: true` and `permissions.additionalDirectories: [A, B]`
- Project `.claude/settings.json` (trusted; `hasTrustDialogAccepted` is `true`, and the trust dialog was re-shown and accepted after resetting the flag): `permissions.additionalDirectories: [C, D]` (absolute paths)
- Also tried an untracked `.claude/settings.local.json` with the same `[C, D]`

**Observed**
- The session's environment header lists A, B, C and D as additional working directories, so the settings are being read.
- Read/Grep/Glob refuse files under C and D with: `... is outside , A, B; the permissions.blockReadsOutsideWorkingDirectories setting blocks reads outside the working directories. Ask the user to add the directory with /add-dir, or to remove that setting.` Only cwd, A and B are listed as allowed.
- The Bash sandbox's read allow-list (`allowWithinDeny`) also contains only cwd, A and B, so `cat` under C fails with `Operation not permitted`.
- `/add-dir C` in the same session works.
- Same result in freshly started sessions, with the project file tracked in git and with the local file untracked.

**Expected** (per docs, permissions.md "Working directories" and "Project allow rules and workspace trust")
- Project/local `additionalDirectories` apply once trust is accepted, and files there are readable without prompts. The read fence should include them.

**Impact**
- Unattended scheduled sessions cannot use project-declared additional directories at all while the read fence is on, since `/add-dir` needs an interactive session.

Reproduce with trusted project .claude/settings.json or settings.local.json, blockReadsOutsideWorkingDirectories enabled, and additionalDirectories C and D. Trace how these settings reach the Read/Grep/Glob fence and Bash allowWithinDeny, comparing the behavior with /add-dir. Done means a fresh session permits access to C and D without interactive /add-dir.

由索引模型根据 Issue 内容生成。