Per vitya's rule an agent may only read its own directory's inbox. The
first global-scan version (all ~/projects inboxes + PI_INBOX_ROOTS) was
scrapped same day; rewrote as session-scoped: watches only
<ctx.cwd>/.claude-inbox/, decoy test proves other inboxes untouched.