Check --option=/path and -o=/path forms against allowedRoots so commands
like ls --directory=/etc are classified as outside_allowed_scope when
the path is outside allowed roots. Addresses Codex PR review feedback.
Co-authored-by: Cursor <cursoragent@cursor.com>
