pub fn workspace_overreach(command: &str) -> Option<(String, ReachReason)>Expand description
If a NOT-auto-approved command reaches a path OUTSIDE the workspace, return that path (its
original spelling) and WHY, so the hook can nudge instead of silently prompting. Resolves against
the ambient cwd/root: relative worktree paths, /tmp, and /dev streams are admitted and
skipped; an absolute or home path that isn’t admitted for read or write is the reach. A
credential store outranks the hidden-peer wording; a hidden peer path outranks the generic
outside-workspace reason.