Fix up #247: route main's other file access through the checked io layer

design.browseTheme reads its path with io::read_file, and File › Info sizes the file with
io::file_len (which checks the read root), so commands_do_not_touch_the_file_system_themselves
passes. spell.rs is allow-listed beside recovery.rs: it touches only the app's own dictionary
folders. main's render_slide MCP tool refuses a `path` argument (#371), so the root tests
render to a file through call_app ui.render instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/engine/src/io.rs

@@ -33,3 +33,16 @@ pub fn write_file(path: &str, bytes: &[u8]) -> Result<(), String> {
 pub fn write_file(path: &str, _bytes: &[u8]) -> Result<(), String> {
     Err(format!("{path}: saving to a path is not available in the browser"))
 }
+
+/// The size in bytes of the file at `path`; `None` when it can't be read (or is outside the
+/// automation read root, so File › Info doesn't reveal files the agent may not read).
+#[cfg(not(target_arch = "wasm32"))]
+pub fn file_len(path: &str) -> Option<u64> {
+    crate::file_access::check_read(path).ok()?;
+    std::fs::metadata(path).ok().map(|m| m.len())
+}
+
+#[cfg(target_arch = "wasm32")]
+pub fn file_len(_path: &str) -> Option<u64> {
+    None
+}