fix: handle outside-workspace error in media store

Address Greptile review: add explicit "outside-workspace" case to
toSaveMediaSourceError so it returns "Media path is outside workspace
root" instead of the generic "Media path is not safe to read".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/media/store.ts

@@ -241,6 +241,10 @@ function toSaveMediaSourceError(err: SafeOpenError): SaveMediaSourceError {
       return new SaveMediaSourceError("too-large", "Media exceeds 5MB limit", { cause: err });
     case "not-found":
       return new SaveMediaSourceError("not-found", "Media path does not exist", { cause: err });
+    case "outside-workspace":
+      return new SaveMediaSourceError("invalid-path", "Media path is outside workspace root", {
+        cause: err,
+      });
     case "invalid-path":
     default:
       return new SaveMediaSourceError("invalid-path", "Media path is not safe to read", {