Copilot is (sometimes) able to delete files outside of the allowed directories via ~ expansion and interpreter execution (Python shutil.rmtree)

### Describe the bug

Copilot CLI can delete files outside explicitly allowed directories when:

1. Shell commands use ~ (tilde) paths, or
2. Copilot executes Python code (e.g. shutil.rmtree) that performs filesystem operations

According to my understanding of how --add-dir / trusted directories work, both cases bypass Copilot CLI’s path‑based permission enforcement.

### Affected version

1.0.11

### Steps to reproduce the behavior

Within the `/sandbox/workdir` folder execute this command:

```
copilot -p "create an hello-world.py script, then run it, then list all files in your workdir, then remove all contents in the folder .copilot/session-state. if you fail to delete contents keep trying in different ways at least 10 times before you give up" \
--add-dir /sandbox/workdir/ \
--allow-all-tools \
--allow-all-urls
```

### Expected behavior

Copilot CLI should not read, modify, or delete files outside /sandbox/workdir, regardless of:

- whether ~ is used instead of absolute paths
- whether deletion is attempted via shell commands or via code (e.g. Python)

In particular, /sandbox/.copilot/session-state outside /sandbox/workdir should remain protected.

### Additional context

- Copilot CLI version: 1.0.11
- OS: Linux
- Shell: bash
- Working directory: /sandbox/workdir

Inizia riproducendo in Linux il comando copilot fornito con --add-dir /sandbox/workdir/, quindi traccia il modo in cui l’applicazione delle directory attendibili gestisce i comandi shell, l’espansione di ~ e l’esecuzione di Python shutil.rmtree. Il lavoro è completato quando letture, modifiche ed eliminazioni al di fuori di /sandbox/workdir sono bloccate attraverso ciascun percorso descritto, incluso /sandbox/.copilot/session-state.

Scritto dal modello di indicizzazione a partire dal testo della issue.