[cherry-pick] [release/1.121] Allow sandbox writes to workspace storage

[vs-code-engineering]

Cherry-pick of #317202 from release/1.121.

⚠️ This cherry-pick has merge conflicts that need manual resolution. Conflict markers (<<<<<<</=======/>>>>>>>) are committed to the branch — check it out locally, resolve, and force-push.

git fetch origin cherry-pick/317202 && git checkout cherry-pick/317202
# resolve conflicts, then:
git add -A && git commit --amend --no-edit && git push --force-with-lease

Conflicting files:

• src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts

---

Summary

• Backport Allow sandbox writes to workspace storage #317160 to release/1.121.
• Allow terminal sandbox writes to workspace storage while preserving home read restrictions.
• Update the focused terminal sandbox service test coverage.

Testing

• ./scripts/test.sh --run src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/browser/terminalSandboxService.test.ts

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.