Let users exclude vault paths from Agent Mode file access

Context

Agent Mode's file tools read, search, and edit anywhere in the open vault. The exclusion list in Copilot's settings only keeps folders and file types out of the semantic index and out of what Miyo registers, so a folder a user excluded from search is still fully readable by an agent. People keep journals, client work, and credentials in the same vault as the notes they want an agent to help with, and today there is no way to keep those out of an agent session.

Reported in https://discord.com/channels/1182847556032659546/1539752633101717604.

User experience

Today a user who excludes a folder from Copilot's index reasonably assumes agents cannot see it, and they can. After this change, a user can name folders, files, or patterns that Agent Mode must not read, search, or edit, and every supported agent respects that list. Attempting to reach an excluded path fails with a clear explanation in the conversation rather than silently returning the content.

Proposed behavior

• Let a user define excluded folders, files, and patterns for Agent Mode file access, separate from the index exclusion list.
• Enforce the exclusion for reads, searches, edits, and shell commands on Claude, opencode, and Codex.
• Keep excluded paths out of file listings and search results, not only out of direct reads.
• Explain in the conversation when an agent was blocked from an excluded path.
• Fail closed and say so when a backend or platform cannot enforce the list, rather than running with full vault access.
• Offer to reuse the existing index exclusions as a starting point rather than making users retype them.

Explicit non-goals

• Restricting access to files outside the vault, or granting extra folders, which #2891 covers.
• Reviewing or revoking permissions a user already granted to a tool, which #2912 covers.
• Encrypting excluded notes, or protecting them from other Obsidian plugins and from the user's own file manager.
• Changing what the semantic index or Miyo already exclude.
• Hiding excluded notes from the non-agent chat modes. Suggested follow-up: Apply Agent Mode path exclusions to chat context selection.

Success criteria

• With a folder excluded, asking an agent to read a note inside it returns a refusal naming the exclusion instead of the note's contents, on each of Claude, opencode, and Codex.
• A vault-wide search or file listing run by an agent returns no excluded path.
• An agent shell command cannot read an excluded path, and a symlink pointing into one does not bypass the list.
• Removing a path from the list restores agent access to it without reinstalling or rebuilding anything.
• On a backend or platform where the boundary cannot be enforced, Copilot says so before the session runs.

Open questions / Risks

• Design needed: the pattern syntax users write, and whether it reuses the index exclusion syntax or a plainer folder picker.
• Enforcement differs per backend. opencode exposes path-glob permission rules, while the other backends need their own mechanism, so each one must be verified end to end rather than inferred from a single implementation.
• Backend permission mechanisms are version-sensitive; an upgrade can silently change or drop a rule, so the boundary needs a check that fails loudly instead of quietly widening access.
• An agent denied a path may retry through a different tool or a shell command; blocking has to sit below the tool layer to hold.