confine editor.open/editor.save to the workspace (T-363)

The editor registry resolved buffer paths with a string join that
passed absolute paths through verbatim and never normalized `..` —
an unconfined read and write primitive over IPC while files.read was
carefully guarded. Buffer paths now resolve through
resolveUnderRootFollowingSymlinks: traversal, absolute escapes, and
symlinks-out are rejected at open, and re-checked at save so a
symlink swapped in under an open buffer's path can't redirect the
write. D-80's extra read roots deliberately do not apply — a buffer
is a write surface. Handlers map PathOutsideRoot to the same error
files.read uses. Also merges a duplicate Added heading that had crept
into the Unreleased changelog section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -23,6 +23,12 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
   below the result — connected only while the card is expanded. Commands with no
   followable file show a muted "nothing to follow" note. (T-325)
 
+- **Double-tap-modifier shortcuts (e.g. double-Shift "Search Everywhere").**
+  The keymap can now bind a bare modifier and a double-tap sequence
+  (`shift shift`). All four presets (default, vim, vscode, jetbrains) map
+  double-Shift to the quick-open finder — JetBrains' "Search Everywhere"
+  gesture, aliased to clide's existing fuzzy file finder. (T-341)
+
 ### Changed
 
 - **Each spawned subagent gets its own collapsing activity card.** A fan-out of
@@ -68,13 +74,12 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
   so the mode indicator and composer stayed stuck on "plan". The approval now
   syncs the tracked mode to `default`. (T-337)
 
-### Added
+### Security
 
-- **Double-tap-modifier shortcuts (e.g. double-Shift "Search Everywhere").**
-  The keymap can now bind a bare modifier and a double-tap sequence
-  (`shift shift`). All four presets (default, vim, vscode, jetbrains) map
-  double-Shift to the quick-open finder — JetBrains' "Search Everywhere"
-  gesture, aliased to clide's existing fuzzy file finder. (T-341)
+- **`editor.open` / `editor.save` are now workspace-confined.** Both verbs
+  accepted absolute paths and `..` traversal verbatim — an unconfined read
+  and write primitive over IPC. They now pass the same path-safety guard as
+  `files.read`, including a symlink re-check at save time. (T-363)
 
 ## [2.3.3] — 2026-06-11