the file browser can actually read a member's home, and plans is gone

"This folder is empty" was a lie. The five seeded directories were sitting there and the
platform's readdir raised EACCES: a member's home is 700 and owned by them, which is
correct for a shell and locks out the file browser, which runs inside the platform
process. /ls caught the error and returned an empty listing, so a refusal looked exactly
like data.

Two doors, two boundaries, and that is the point rather than a compromise. The terminal
and the agent RUN AS the member and the kernel is the boundary there. The file browser
acts on the member's behalf from inside the platform, which already applies its own
containment and is the owner's process on the owner's machine — it can read anything via
sudo regardless. Giving it access describes who is doing the work.

Done with named POSIX ACLs, because it has to hold in BOTH directions: a file the
platform writes must be editable by the member and vice versa. Mode bits cannot say that
— whichever party is neither owner nor group lands in "other", and widening "other"
opens the home to every account on the box. A shared group fails the same way, since both
parties would have to be in it and that puts every member in a group that can read every
other member's home. Two named entries plus `d:` defaults grant exactly two users and are
inherited by whatever either side creates, whatever their umask.

Verified: platform lists the home, member edits a platform-written file, platform edits a
member-written file, and a SECOND member is refused on both ls and cat.

/ls now distinguishes EACCES from a missing directory. An empty result is data and must
never be how a refusal looks.

acl joins the core packages in setup.sh — the alternative is an account that provisions
and then cannot list its own home.

Also: the file browser's own useTasks/useAgents fired /tasks, /agents and both category
endpoints on every render, which is where the last four 403s came from — they are the
context menu's Run Task and agent submenus, execution-only. Gated.

And plans is deleted: router, screen, routes, dock tile, hook, page title and its
capability. It read markdown from <repo>/plans, which does not exist. Fresh-install
Permissions is now Files alone, with Terminal to come.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup.sh

@@ -230,6 +230,21 @@ case $PM in
     ;;
 esac
 
+# acl — setfacl/getfacl, needed by per-user Linux accounts.
+#
+# A member's home is 700 and owned by them, which is right for a shell and locks the platform out of the
+# file browser. Named ACL entries are what let both act on the same files without opening the home to every
+# account on the box; mode bits cannot express it in both directions. Core rather than a profile extra
+# because the alternative is an account that provisions and then cannot list its own home.
+case $PM in
+  apt)
+    if dpkg -s acl &>/dev/null 2>&1; then skip "acl"; else CORE_PKGS+=(acl); fi
+    ;;
+  pacman|dnf|yum)
+    if has setfacl; then skip "acl"; else CORE_PKGS+=(acl); fi
+    ;;
+esac
+
 if [ ${#CORE_PKGS[@]} -gt 0 ]; then
   install_pkg "${CORE_PKGS[@]}"
   ok "Installed: ${CORE_PKGS[*]}"