Allow Grok plan.md writes when home is the workspace

[shugav]

Fixes #10.

Summary

Plan mode should allow and snoop Grok's own .grok/sessions/.../plan.md writes, but v1.2.2 can still block them when the VS Code workspace root is the user's home directory. In that layout, the plan file is both:

• recognized as Grok's plan file, and
• inside the workspace containment root

This updates the write gate so plan-file writes are exempted before workspace containment is applied, but only when the path is under the resolved Grok home (~/.grok). That keeps normal workspace writes blocked and avoids treating an arbitrary project-local .grok/sessions/.../plan.md as Grok's own session file.

Verification

• Added a regression test covering both POSIX home workspace and Windows home workspace layouts.
• Added a guard test that a project-local .grok/sessions/.../plan.md remains blocked when it is not under the resolved Grok home.
• Verified the home-workspace regression test fails before the source fix.
• npm test -- --run test/plan-gate.test.ts test/acp-integration.test.ts (49 tests)
• npm run compile
• git diff --check
• npm test (223 tests)
• npm run package

Local confirmation

After installing the patched VSIX locally, the exact observed path now evaluates correctly:

isPlanFileWrite('/home/shugav/.grok/sessions/%2Fhome%2Fshugav/019e7608-.../plan.md') === true
isInsideWorkspace(..., '/home/shugav') === true
shouldBlockWrite(..., {
  active: true,
  workspaceRoot: '/home/shugav',
  grokHome: '/home/shugav/.grok'
}) === false

Notes

This preserves the existing Plan mode design: normal workspace writes remain blocked while planning, but Grok's CLI-owned plan file remains allowed and snooped even when the user opens their home directory as the workspace.

[phuryn]

Thanks for this!