Artifact permission checks extended to Artifact-type-authored files and scratchpad symlink escapes

Artifact permission checks now distinguish files that come from an Artifact type the publisher authored from files published by a co-writer, using separate wording for each case. They also detect when a save path is nominally under the session scratchpad but a symlink there resolves outside the scratchpad carve-out; both new cases require user approval rather than classifier approval.