Define Strict-mode sensitive file read warning behavior

[yikkuro]

Problem

The Data & Privacy → Strict mode currently claims:

Warn before reading sensitive files (.env, keys, certs)

The page also shows a Sensitive File Guard section with patterns such as .env, *_key*, *.pem, *.p12, *.pfx, id_rsa, and credentials, and says the agent asks for confirmation before reading matches.

This behavior is not implemented. The patterns and warning are display-only: no privacy-level hook intercepts file reads or opens a confirmation flow. The existing sensitive-shield.ts feature is unrelated; it applies sandbox ACL protection to credential directories and does not implement per-file read warnings.

Why this needs product definition

Before implementation, clarify:

1. Which access paths should trigger a warning: shell/tool reads, attachment reads, app-owned reads, or all of them?
2. Should matching use filename patterns, full paths, known sensitive directories, content detection, or a combination?
3. What decisions should the dialog support: allow once, allow for session, always allow, and deny?
4. Should Strict block until explicit approval, or only notify/audit?
5. How should non-interactive/background and remote-channel requests behave?
6. Is the feature controlled only by Strict mode, or should Sensitive File Guard have its own toggle/configuration?
7. Should File Access Audit record approvals, denials, and reads, and where should that audit be visible?
8. What are the expected failure-safe semantics when the UI is unavailable?

Current impact

Strict mode promises protection that users do not receive, creating a privacy/security expectation mismatch.

Interim/product options

• Define and implement the confirmation behavior end to end; or
• Remove/reword the Strict-mode and Sensitive File Guard claims until the feature exists.

Acceptance criteria

• PM-approved behavior and scope are documented.
• UI copy accurately reflects implemented behavior.
• If implemented, sensitive-file reads are covered across the approved access paths with explicit fail-safe behavior and tests.