fix(k3s): move allowed paths to tools section and fix subagent workspace persistence

k3s/configmap.yaml

@@ -14,14 +14,6 @@ data:
         "defaults": {
           "workspace": "/home/picoclaw/.picoclaw",
           "restrict_to_workspace": true,
-          "allow_read_paths": [
-            "/home/picoclaw/.picoclaw",
-            "/tmp"
-          ],
-          "allow_write_paths": [
-            "/home/picoclaw/.picoclaw",
-            "/tmp"
-          ],
           "provider": "nvidia",
           "model_name": "nemotron-120b",
           "model_fallbacks": [
@@ -729,8 +721,14 @@ data:
         }
       },
       "tools": {
-        "allow_read_paths": null,
-        "allow_write_paths": null,
+        "allow_read_paths": [
+          "/home/picoclaw/.picoclaw",
+          "/tmp"
+        ],
+        "allow_write_paths": [
+          "/home/picoclaw/.picoclaw",
+          "/tmp"
+        ],
         "deny_read_paths": [
           "^skills(/.*)?$"
         ],

pkg/agent/instance.go

@@ -307,7 +307,7 @@ func resolveAgentWorkspace(agentCfg *config.AgentConfig, defaults *config.AgentD
 	}
 	// For named agents without explicit workspace, use default workspace with agent ID suffix
 	id := routing.NormalizeAgentID(agentCfg.ID)
-	return filepath.Join(expandHome(defaults.Workspace), "..", "workspace-"+id)
+	return filepath.Join(expandHome(defaults.Workspace), "workspaces", id)
 }
 
 // resolveAgentModel resolves the primary model for an agent.