The shared workspace is one-way: the agent can give you files, you cannot give it any

`~/shared` is described to the agent, in its own system prompt, as a two-way workspace:

> ~/shared is a workspace you SHARE with your owner: anything you put there they can see and open from their panel, **and anything they leave there you can read**.

The second half is not true. `IHomeBrowser` exposes `ListShared`, `ReadShared` and `DownloadShared` and nothing else — there is no write, and no endpoint under `/api/shared` that accepts one. A person can watch what the agent produces and take a copy; they cannot hand it a spreadsheet to fix, a CSV to summarise, or a document to read.

That makes a whole class of ordinary request impossible. "Clean up this file" has no way to begin, and the agent has been told to expect it.

## What to build

An upload into the owner's shared volume. The pieces it needs are the interesting part, not the endpoint:

- **Through the command bus**, like every other mutation. A file arriving in a workspace the agent reads is an input to everything it does next, so it is exactly the kind of event the audit trail exists to record.
- **Size and type bounded**, and enforced on the server rather than in the browser.
- **Written through the same descriptor guard as the reads.** `PodmanHomeBrowser` opens a path once and asks the kernel what it actually opened, because a session owns its home and can leave a symlink in it. A write that resolves by name instead would be the hole the reads were careful to avoid — and a write is worse, because it creates rather than merely discloses.
- **The filename is untrusted input.** It arrives from a browser and ends up on a filesystem the agent reads.

## Why it matters beyond convenience

The agent tells people files are shared both ways. Software that describes a capability it does not have teaches people to distrust the parts that do work — and here it is the agent's own voice making the claim, which is the voice this product needs people to believe.

Found while building the portal's Files view (which is read-only for this reason).

Start by tracing IHomeBrowser's ListShared, ReadShared, and DownloadShared implementations through the /api/shared entry point and command bus. Compare PodmanHomeBrowser's descriptor guard for reads, then identify the existing audit, size, and type validation paths. Done means a bounded, validated upload is recorded through the command bus and safely readable from the shared volume.

Written by the indexing model from the issue text.