Read and change a machine's files from the backend

The first half of EXPLORER.md: server/src/files.rs, which lists a
directory, reads a file, writes one, and creates a file or a directory on
whichever machine a setup names.

Each operation is one small POSIX script run through `Transport`, the way
the import listing and the usage fetch already ask a machine a question,
so the local and the ssh case are one implementation rather than two that
drift. The path crosses as a positional argument and never as script
text; `PATH_PRELUDE` is the one line that gives a leading `~` its
meaning, because a shell expands a tilde in text and not in an argument,
and it is the far machine's home that has to answer.

A read has four answers -- text, binary, tooBig, or the machine's own
error -- because a binary file drawn as text and a big one cut off
silently are both wrong in ways the reader cannot see. A write carries
the sha256 the read reported and is refused with a 409 when the file has
moved on, which is what happens whenever an agent is editing the file
somebody is reading.

`Transport::capture_with_input` is the one description of "run this
there, with this on stdin", and `ship_attachment` moves onto it rather
than assembling a second ssh invocation of its own. It is also the only
capture that hands back the exit status, which is how the write says
"this is not the file you read" without that answer looking like a
failure.

Exercised on both transports against the sandbox -- ssh to this VM with a
throwaway key, since the quoting and the stdin path are what that proves
-- including a filename with an apostrophe, one with a tab, an unreadable
file, a binary one, one over the limit, and the 409.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

AGENTS.md

@@ -57,6 +57,20 @@ repo is in PLAN.md's "Backend layout" section.
   finishes between two polls reads as idle at both, and its own output
   gets replayed on top of itself. That bug was visible on screen as
   `donedone`.
+- `server/src/files.rs` — the file explorer's half of the backend:
+  listing a directory, reading a file, writing one, creating a file or a
+  directory, on whichever machine a setup names. Each is one small POSIX
+  script run through `Transport`, so the local and the ssh case are the
+  same code and a machine the backend cannot reach fails with ssh's own
+  message. The path is a **positional argument**, never text spliced into
+  the script; `PATH_PRELUDE` is the one line that gives a leading `~` its
+  meaning, since a shell expands a tilde in text and not in an argument.
+  A read has four answers — `text`, `binary`, `tooBig`, or the machine's
+  own error — because a binary file drawn as text and a big one cut off
+  silently are both wrong in ways the reader cannot see. A write carries
+  the sha256 the read reported and is refused (409) when the file has
+  moved on, which is the ordinary case when an agent is editing the same
+  file. `EXPLORER.md` is the design.
 - `server/src/usage.rs` — rate-limit windows, asked **of each machine that
   can run Claude**, not of the backend. Credentials are read through the
   session `Transport`, so a remote setup is an ssh round trip and the local