revert: drop unsafe outbound attachment relocation, keep only the visible failure notice

The staging logic in 9c46cf6 copied any agent-declared file from outside the
room's allowed directories into a safe folder and attached it, which bypassed
the attachment directory allowlist (cross-room isolation / sensitive-file
protection). Removing it.

Kept: appendRejectionNotice / describeRejectedAttachments so rejected
attachments are surfaced in the visible message instead of being silently
dropped. This changes no security behavior — it only adds text when an
attachment was already going to be rejected.

Verified: outbound-attachments + final-delivery + discord tests 70/70, tsc clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/message-runtime-final-delivery.ts

@@ -2,10 +2,6 @@ import { createProducedWorkItem } from './db.js';
 import { resolveRuntimeAttachmentBaseDirs } from './attachment-base-dirs.js';
 import { logger } from './logger.js';
 import { deliverOpenWorkItem } from './message-runtime-delivery.js';
-import {
-  getOutboundStageDir,
-  stageOutboundAttachments,
-} from './outbound-attachments.js';
 import type {
   AgentType,
   Channel,
@@ -54,19 +50,6 @@ export async function deliverMessageRuntimeFinalText(args: {
     return true;
   }
 
-  const attachmentBaseDirs = resolveRuntimeAttachmentBaseDirs(args.group);
-  // Relocate attachments that live outside the room's allowed directories into
-  // a safe staging dir before persisting the work item, so the path delivery
-  // actually uses (and revalidates) is one the validator accepts. Without this,
-  // agent-generated files written to an arbitrary working path are rejected as
-  // "outside-allowed-dirs" and silently dropped.
-  const attachments = args.attachments?.length
-    ? stageOutboundAttachments(args.attachments, {
-        baseDirs: attachmentBaseDirs,
-        stageDir: getOutboundStageDir(args.group.folder),
-      })
-    : args.attachments;
-
   const workItem = createProducedWorkItem({
     group_folder: args.group.folder,
     chat_jid: args.chatJid,
@@ -76,14 +59,14 @@ export async function deliverMessageRuntimeFinalText(args: {
     start_seq: args.startSeq,
     end_seq: args.endSeq,
     result_payload: args.text,
-    attachments,
+    attachments: args.attachments,
   });
 
   return deliverOpenWorkItem({
     channel: args.channel,
     item: workItem,
     log: logger,
-    attachmentBaseDirs,
+    attachmentBaseDirs: resolveRuntimeAttachmentBaseDirs(args.group),
     replaceMessageId: args.replaceMessageId,
     isDuplicateOfLastBotFinal: args.isDuplicateOfLastBotFinal,
     openContinuation: args.openContinuation,