refactor: trim unused filesystem allowlist state

maintainer edit: simplify the exact-file allowlist follow-up by removing unused read-side state and keeping the exact path helper private to workspace_policy.

nanobot/security/workspace_policy.py

@@ -44,7 +44,7 @@ def is_path_allowed(path: str | Path, roots: Iterable[str | Path]) -> bool:
     return any(is_path_within(path, root) for root in roots)
 
 
-def is_path_exactly_allowed(path: str | Path, files: Iterable[str | Path]) -> bool:
+def _is_path_exactly_allowed(path: str | Path, files: Iterable[str | Path]) -> bool:
     """Return True when *path* resolves exactly to one of the allowed files."""
     try:
         resolved_path = Path(path).expanduser().resolve(strict=False)
@@ -96,7 +96,7 @@ def resolve_allowed_path(
     if allowed_root is not None:
         roots.append(allowed_root)
     roots.extend(extra_allowed_roots or [])
-    if not is_path_allowed(resolved, roots) and not is_path_exactly_allowed(resolved, files):
+    if not is_path_allowed(resolved, roots) and not _is_path_exactly_allowed(resolved, files):
         boundary = Path(allowed_root).expanduser() if allowed_root is not None else "allowed files"
         raise WorkspaceBoundaryError(
             f"Path {path} is outside allowed directory {boundary}"