CLI --attach should allow explicit operator-named paths outside the root

[tobert]

Problem

When running kaibo from the CLI, an explicit --attach /tmp/some-file.diff is currently refused unless /tmp is also added to the allowed path set:

path /tmp/kaibo-openai-hosted-review.diff resolves to /tmp/kaibo-openai-hosted-review.diff, which is outside the allowed set [...]

That is correct for model-steered reads, but awkward for the operator-facing CLI. If the human explicitly names a file as an attachment on the command line, kaibo should probably treat that file as an operator-provided input and make it work without requiring a separate --allow-path.

Desired shape

• kaibo oneshot --attach /tmp/foo.diff ... should read that explicit file.
• kaibo consult --attach /tmp/foo.diff --path REPO ... should make the explicit attachment available to the consultation.
• This should not widen the model-facing read boundary. run_kaish, view_image, and model-chosen paths should still be constrained to the allowed roots.
• The implementation should preserve the existing symlink/canonicalization discipline and loudly reject missing, unreadable, special-file, or oversized attachments as today.

Notes

This surfaced while dogfooding a cross-family review: we wrote git diff to /tmp and tried to attach it to kaibo oneshot; kaibo correctly required --allow-path /tmp, but that extra knob is unnecessary friction for an explicit CLI argument.