Under the hood
New internal state tracks restricted workspace roots and which settings sources apply within them.
Launch options gain workspaceRestrictionState and restrictedWorkspaceRoots tracking, used to determine whether a directory falls under a restricted workspace root and to gate certain features via per-root gate keys. A new allowedSettingSourcesWithoutRepoDirSources list also restricts which setting sources apply when a workspace restriction is active.