docs(api): remove obsolete media path restrictions

packages/api/session-controller/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/api/session-controller/README.md
-README.md: deeade0dee6602c0f5e75e0d9321b4b5223d0f24
-README.zh.md: 143774977e5cf62db57c00ad22e1a52467592b42
+README.md: 7d0785c77395f9eae55656708a15a842a27f079b
+README.zh.md: b39a6a512b82cef45550d11660b7a87b2cd0b035

packages/api/session-controller/README.md

@@ -64,7 +64,6 @@ No direct effect; model requests remain owned by the Agent and LLM packages.
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- Media reads use Host files under registered workspace roots. Temporary files outside those roots return 403; files available only in a remote filesystem provider cannot be served. The route does not use `ctx.fs`; its read permissions differ from `read_image`.
 - The image byte cap does not validate decoded dimensions or pixel count.
 - Control baselines represent process-local state and therefore cannot reconstruct jobs after a Host restart.
 - A failed follow resumption remains visible to the caller instead of retrying indefinitely.

packages/api/session-controller/README.zh.md

@@ -64,7 +64,6 @@ Session 对象还承载本地提交回显：`session.beginSubmission` 在调用
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- 媒体读取使用已注册 workspace 根内的 Host 文件。根外临时文件返回 403；仅存在于远程文件系统提供方中的文件无法提供。该路由不使用 `ctx.fs`，其读取权限与 `read_image` 不同。
 - 图片字节上限不校验解码后的尺寸或像素数。
 - Control baseline 表示进程本地状态，因此 Host 重启后无法重建 jobs。
 - follow 恢复失败会对调用方可见，而不会无限重试。