App directory read access is invisible to the tool and to OpenShell logs #14

Summary

context7 failed at startup because /opt/context7 was not readable in the sandbox. OpenShell does not log the EACCES (OpenShell #4270, tracked locally only), and openshell-annotate knows interpreter paths from [languages] but not the application directory.

Proposal

• generate --image IMAGE: inspect WORKDIR, entrypoint and app dirs in the image and propose fs read entries.
• And/or a lint hint: "binary path /opt/... is outside the baseline read set".

Actual

No warning, and a silent failure at runtime.

Found while testing five real projects (see the local candidate report). Numbered #8 in that report.