feat: scope a session from a declaration the agent cannot widen

The facet root was the session's working directory and nothing else, so the
only way to scope a conversation to a module was to make the module a
workspace — and the only way to reach anything outside it was `extraRoots`,
which is a fact about the deployment rather than about one conversation.

Scope now has two layers, and the split is the point. The **user layer** is
`config.scopes[sessionId]` — a `focus` and a list of `extras`, written only
from the browser context panel through the settings service, which is what
`settings.mutate` requiring a volatile path buys us. The **agent layer** is in
memory: a narrowing `focus` and its grants. Both can only ever reduce what the
user layer allows, so an agent that goes wrong cannot widen its own scope.

`facet action=focus` is therefore the one scope change the agent may make
unasked, bounded by the scope already in force and decided on canonical targets.
`reset` clears the agent's side only, landing on the user's declaration rather
than on the session directory — landing on the directory would have made
`reset` a widening. `extraRoots` demotes to an optional deployment-wide seed.

The binding now names the context panel as the way to widen, because it is: in
a deployment with no approval channel, `facet action=add` cannot be granted at
all.

lib/scope.js

@@ -195,12 +195,12 @@ export function facetContextText(input) {
   // the reason this guard writes never reaches it: `serviceAsk` replaces a
   // rejected ask with `the user rejected tool "…"`. So the binding is the one
   // channel that can say what is true, and it names the mechanism that still
-  // works — `extraRoots` is configuration applied by the profile, not a grant
-  // asked for per conversation.
+  // works: the facet's context panel, which the user owns and the agent has no
+  // write path to.
   const reach = !canAsk
-    ? 'refused — approval prompts are off in this session, so `facet action=add` cannot be approved either; only the user can widen this, by adding the path to `extraRoots`'
+    ? 'refused — this session has no approval channel, so `facet action=add` cannot be granted; ask the user to widen the facet from its context panel'
     : mode === 'deny'
-      ? 'refused — `facet action=add` asks the user to grant a path, and is the only way to widen the scope'
+      ? 'refused — ask the user to widen the facet from its context panel, or with `facet action=add` where that can be granted'
       : 'put to the user as a question — say in one line what you need and why, then record it with `facet action=add` so the rest of the session does not have to ask again'
 
   // The root is stated absolutely even though it is the session's own directory