Context

PR #25660 adds per-agent profile roots, but stronger filesystem isolation guards are explicitly future work.

Work

• Define what paths each profile may read/write by default.
• Prevent accidental cross-profile access where filesystem tools or profile overrides could leak state.
• Add tests for allowed and denied profile filesystem access.

Source

Follow-up from #25660.

Referenced by #25660.