fix(config): judge a grant against the home the package already resolves

The process-input gate counts a direct os.UserHomeDir call; folder grants now use
the package's injectable osUserHomeDir like the other home lookups here.

internal/contract/config/workspace_roots.go

@@ -150,7 +150,7 @@ func (r Roots) FolderGrantRefusal(dir string) (WorkspaceRootRefusal, bool) {
 	if key == "." || filepath.Dir(key) == key {
 		return RootTooBroad, true
 	}
-	if home, err := os.UserHomeDir(); err == nil && home != "" && keyWithin(rootKey(home), key) {
+	if home, err := osUserHomeDir(); err == nil && home != "" && keyWithin(rootKey(home), key) {
 		return RootTooBroad, true
 	}
 	var guarded []string