feat(tools): document and configure [tools.file] read sandbox

[bug-ops]

Summary

Follow-ups from #2488/#2489 ([tools.file] read sandbox implementation):

• enhancement(tools): add commented [tools.file] example to config/default.toml #2526: Add commented-out [tools.file] section with deny_read/allow_read glob examples to config/default.toml so users discover the feature
• enhancement(tools): add [tools.file] section to --init wizard #2525: Add [tools.file] wizard step to --init interactive config — two prompts in step_security() with conditional allow_read prompt shown only when deny_read is non-empty; two new tests
• docs(tools): document [tools.file] read sandbox in book #2527: Add book/src/reference/security/file-sandbox.md documenting deny-then-allow evaluation, canonicalization, glob syntax, practical examples, and security guidance; linked in SUMMARY.md

Test plan

• cargo +nightly fmt --check passes
• cargo clippy --workspace -- -D warnings passes (0 warnings)
• cargo nextest run --workspace --lib --bins passes (6999 passed)
• Run cargo run -- --init and verify [tools.file] prompts appear in the security step
• Verify config/default.toml renders correctly with commented section
• Build mdBook (mdbook build book/) and verify file-sandbox page renders

Closes #2525, #2526, #2527