fix(sandbox): expose resource mounts to file tools

[yanpgwang]

Summary

• allow standard file tools to access explicitly provisioned Session File and Memory Store mounts
• preserve read-only boundaries for uploads, Skills, and read-only Memory Stores
• keep workspace traversal and unrelated absolute paths rejected
• restore the same authority after Docker provider reattachment

Why

Managed Agents advertises mounted Files and Memory Stores at absolute sandbox paths, but Docker ReadFile and WriteFile previously rebased every path beneath /workspace. As a result, Read/Write/Edit could silently target /workspace/mnt/... while Bash saw the real mount.

Verification

• make verify
• make test-service
• focused Docker tests covering File Resources, read-write and read-only Memory Stores, traversal rejection, and provider reattachment