Function configured_allowed_roots 

pub fn configured_allowed_roots() -> &'static [PathBuf]

Effective operator-configured roots outside the workspace. Exposed for diagnostics so doctor reports the same once-read policy the file tools use.