[spytensor]

What changed

• Resolve filesystem read and write roots through one authorization contract.
• Bind runtime and delegated system prompts to the authenticated user's canonical workspace.
• Keep Full Access read/write behavior symmetric for the configured shared workspace while preserving delegated hard pins and sensitive-write protection.
• Return filesystem roots for the authenticated user instead of a process-global default.

Root cause

The runtime advertised one workspace path, writes admitted that path at Full Access, but reads/listing/image analysis resolved a different per-user allowlist. A task could therefore write a deliverable successfully and then be denied when verifying or reopening the exact same file.

Validation

• Targeted Vitest: 5 files, 61 tests passed, including UUID-user write-then-read coverage.
• pnpm typecheck
• pnpm build
• pnpm verify:public-export