tools: new_temporary_workspace with cross-platform allowlist

Create scratch dirs under system temp (tempfile), allow absolute paths
under them without rebinding the project workspace or session. Cleanup
owned temps on chat exit. Cap 16 concurrent temps; sanitize prefix.

tests/test_tools/conftest.py

@@ -4,7 +4,11 @@ from typing import TYPE_CHECKING
 
 import pytest
 
-from plyngent.tools.workspace import clear_workspace_root, set_workspace_root
+from plyngent.tools.workspace import (
+    clear_workspace_allowlist,
+    clear_workspace_root,
+    set_workspace_root,
+)
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -14,6 +18,8 @@ if TYPE_CHECKING:
 @pytest.fixture
 def workspace(tmp_path: Path) -> Iterator[Path]:
     clear_workspace_root()
+    clear_workspace_allowlist()
     root = set_workspace_root(tmp_path)
     yield root
+    clear_workspace_allowlist()
     clear_workspace_root()