Agent reads files outside the project directory without approval, ignoring an explicit "inspect only this directory" instruction

## What happened

A tester opened an unpublished project and asked Orbit to inspect *only* the current project directory -- listing a few named subfolders -- and explicitly to not run analysis yet. Instead, Orbit reported that it had read experiment-metadata files on the Desktop and inferred prior experiment details/results from an external experiment folder before drafting its plan.

## Why it matters

For unpublished data, the agent crossing an explicit data-access boundary is a real problem. It should stay inside the working directory unless the user approves an external path.

## Why it happens

The exec-guard workspace jail covers writes and *sensitive* reads, but ordinary reads outside the workspace are allowed silently -- `extensions/loom/exec-guard/policy.ts` returns `read:ok` for any non-sensitive path regardless of whether it's inside the working dir. There's no read-jail and no prompt on out-of-workspace reads.

## Suggested direction

Design call: either prompt before reading outside the working directory, or add an opt-in read-jail. Either way the explicit "only this directory" instruction should be honored.

Environment: Windows 11 + WSL2 Ubuntu, Orbit v0.3.1.