feat: intern region entry content at the runtime boundary - #3

First version to ride the automated pipeline end to end: alpha builds
it, beta and prod promote it, and prod's publish-crates job pushes all
twelve crates to crates.io from the promoted commit. Carries the launch
cleanup (service label migration, corrected run hint, refreshed crate
pages) to the registry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Km9mfcU1ezK2HgB9SJa2R2

Reworks the [read_paths] allowlist so it fits the repo's tighten-only
invariant and cannot be used to widen an agent's reach past what the user
granted.

- Reads and writes no longer share one resolver. read_file/read_files/
  list_dir get a new resolve_read() with the allowlist fallback; write_file
  and edit_file stay confined to the workdir.
- glob/regex entries match the symlink-resolved canonical path (the previous
  resolves_within(p, p) check was a self-comparison, always true). Regexes are
  auto-anchored; Windows matching is case-insensitive with the \\?\ prefix
  stripped. Entry matching moves to a new leviath-core::read_paths module.
- A blueprint's declarations are inert unless the user's config grants them:
  [security] read_paths, [agent_read_paths.<name>], or the
  allow_blueprint_read_paths override. Ungranted declarations warn at spawn
  with the exact stanza to add.
- [read_paths] is now parsed by manifest.rs (it was never read before, so the
  feature was inert through `lev run`); invalid entries are hard errors.
- ~/ expands via LEVIATH_HOME-aware home_dir(); bare relative entries resolve
  against the workdir; a new `lev run --workdir` sets that workdir.
- Read tools are classified Private when a grant is active. Capabilities are
  surfaced in `lev add` and `lev validate`; docs updated in SECURITY.md and
  the security/agents/cli pages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

`/..` is not absolute on Windows, so the workdir join reshaped it and the
"cannot be resolved" bail in resolve_outside never fired there, leaving
exec.rs:142 uncovered on windows-latest. Drive it with a leading `..`
against an empty base, which yields a leading ParentDir on every platform.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…base

The prior fix (`../x` against an empty base) still missed exec.rs:142 on
windows-latest: an empty base is not absolute there and the join reshapes it
so pop() never fails. Mirror resolve_rejects_excessive_parent_dir_traversal
instead - a relative base "wd" gives exactly one leading Normal component with
no platform-specific prefix, so the first `..` pops it and the second pops an
empty accumulator, firing the bail on every OS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>