fix: allow local Brain to bind folders outside home directory

Summary

Fix local workspace binding for folders that live outside the user's home directory or EIGENT_WORKSPACE.

Local desktop deployments are detected with filesystem_scope="full", but EnvironmentHands.can_access_filesystem() was still restricting that scope to the home directory and configured workspace root. On Windows this rejects valid folders on another drive (for example D:\...) and surfaces as:

That folder is not available to this Brain.

The change makes full mean unrestricted filesystem capability as declared by BrainCapabilities, while leaving workspace_only unchanged for sandbox/container deployments.

Changes

• allow any resolvable path when filesystem_scope == "full"
• keep workspace_only restricted to the configured workspace root
• add regression coverage for both behaviors

Path existence and directory validation remain in the workspace binding endpoint, so this only fixes the capability check; it does not bypass normal bind-path validation.

Validation

Validated on Windows with a local Brain by binding a folder outside the user profile / workspace root, including a folder on D:. The previous code rejects that path; this change allows it while the workspace_only regression test still rejects paths outside its workspace.

Fixes #1766