s03_permission: Agent bypasses workspace validation through bash

[avan-debug]

When file operations (read_file, write_file, edit_file) access paths outside WORKDIR, the permission check correctly returns:
Path escapes workspace
However, the agent bypasses the restriction by switching to the bash tool to directly access files outside the workspace.
The current permission mechanism only validates individual file tools and does not prevent equivalent operations through other tools.

[dajiaohuang]

Verified on current main (eb4307f): Gate 2 applies the workspace-path check to read_file, write_file, and edit_file, while bash only matches a few destructive command substrings. The three READMEs describe Gate 2 as covering reads/writes outside the workspace, so equivalent shell access currently bypasses the user-approval path.

Before implementing, which teaching contract should s03 use?

1. Keep the rules intentionally illustrative and document explicitly that they are not workspace isolation or a sandbox.
2. Make workspace containment a cross-tool invariant. That would need an OS/shell boundary design (for example, a constrained command interface or sandboxed subprocess), not another keyword-list entry.

I lean toward option 1 for a minimal teaching chapter unless cross-tool containment is a core goal. If option 2 is intended, which platforms and shell operations should the lesson support?