fix(workspace-fs): allow viewing symlinks outside workspace root - #7897

The editor can open any file on the host since #7897, but saving one outside
the workspace root (or through an in-root symlink that resolves outside) threw
"Path is outside workspace root". writeFile now follows the read policy: the
same caller can already read any file and run any command in a terminal, so
confining edits was not a real boundary. Create, delete, move and copy stay
confined to the root.

* docs: weekly update for PRs merged 2026-09-23 to 2026-09-30

Source of truth: live Notion SOP "Weekly Docs Update (automation SOP)".
Window: merged:>=2026-09-23 (139 PRs). PRs through the morning of 09-23
were covered by #7771.

Changes
- Pages: no auto-open on publish (#7790); page links and URL links split
  into their own settings (#7916, #7962, #7946); Listening agents menu with
  per-row stop and Add listening agent (#7724, #7820, #7919); globe on the
  Share button (#7766); Report on public pages (#7886); agents offer a page
  (#7759). Files: pages.mdx, cli/cli-reference.mdx.
- Settings moves: Links replaced by Browser and Files & Editor (#7916,
  #7962). Files: editor.mdx, terminal-integration.mdx, customization.mdx.
- Editor: inline rename and drag to move (#7692), Auto Save (#7693, #7916),
  open and save files outside the workspace (#7897, #7982), Copy as Markdown
  (#7591), per-pane error screen (#7983). File: editor.mdx.
- Terminal copy follows Ghostty's whitespace rules (#7868).
  File: terminal-integration.mdx.
- Agents: UFO (#7898); GPT-6 Astra, Sonnet 5.5, retiring GPT-5.5, retired
  GPT-5.4/5.3 Codex (#7783, #7894, #7935). Files: agent-integration.mdx,
  cli/cli-reference.mdx.
- Host: superset start --daemon --auto-update and update-lock permission
  errors (#7735, #7952). Files: cli/host-server.mdx, cli/cli-reference.mdx.
- Removed the mcp CLI section and the Connected Service Plugins section:
  #7776 made plugins/mcp internal, the Plugins page is staff-flagged, and
  apps/docs/AGENTS.md keeps internal commands out. Files: skills.mdx,
  cli/cli-reference.mdx.
- Slack page unfurls and details panel (#7817, #7821, #7914, #7957).
  File: use-with-slack.mdx.
- Workspaces: instant creation with background naming (#7518); recoverable
  project deletion (#7896). File: workspaces.mdx.
- Shortcuts: prev/next workspace includes Pinned and wraps (#7851); ⌘B
  collapses the sidebar to a rail (#7964). File: keyboard-shortcuts.mdx.
- Ship controls and open-in button moved to the right sidebar strip (#7958).
  Files: diff-viewer.mdx, use-with-ide.mdx.

Deliberately skipped
- Cloud workspaces/environments/sandboxes (flag-gated, AGENTS.md rule):
  #7784 #7795 #7824 #7840 #7844 #7845 #7847 #7849 #7850 #7858 #7861 #7863
  #7874 #7911 #7913 #7918 #7922 #7931 #7932 #7937 #7956 #7961 #7969 #7981
  #7637 #7794 #7789 #7838 (its CLI docs already shipped in the PR).
- Staff-only plugins: #7912 Sentry plugin, #7716, #7727, #7955.
- Already documented in their own PRs: #7917, #7921.
- Removed feature never documented: #7796 Google Calendar triggers.
- Agents chip remove/revert/default-off, never documented: #7870 #7871 #7872.
- Billing/backend policy with no docs surface: #7947, #7812, #7786, #7792,
  #7798, #7761, #7948, #7949, #7951, #7827.
- Reverted security trio: #7828 #7829 #7830 (reverted by #7834).
- Fixes restoring expected behavior: #7683 #7696 #7707 #7743 #7751 #7756
  #7764 #7765 #7781 #7788 #7791 #7823 #7825 #7833 #7837 #7852 #7857 #7860
  #7864 #7865 #7869 #7873 #7897-covered #7903 #7938 #7980 #7943 #7964-chrome.
- Mobile (no docs page): #7746 #7747 #7748 #7749 #7750 #7782 #7793 #7810
  #7814 #7816 #7889 #7968.
- Marketing, internal docs, CI, version bumps: #7651 #7744 #7752 #7771 #7774
  #7776-infra #7777 #7785 #7811 #7818 #7822 #7826 #7834 #7884 #7885 #7895
  #7909 #7933 #7934 #7942 #7944 #7965 #7966.

Validation: bun run --cwd apps/docs typecheck, bun run lint:fix,
bun run lint (exit 0), Vale on 13 changed files (0 errors, 0 warnings),
git diff --check.

* chore: log weekly docs update follow-ups

* docs: tighten review findings in the weekly update

Only the page creator can stop or add listening agents. On focus change also
saves on window blur, and Auto Save pauses on conflicts. Taken-down pages do
not unfurl. Model picker coverage matches agent-models.ts.