fix(s03,s04,s20): remove dead safe_path, sync READMEs

- Delete safe_path entirely (following PR #483 approach) — no dead code
- Update all 3 READMEs per module to reflect read_file in Gate 2
- s04: also update permission_hook snippet in READMEs
- s20: remove safe_path (already replaced with inline resolution)

Closes #482

s04_hooks/README.en.md

@@ -108,7 +108,7 @@ def permission_hook(block):
         for pattern in DENY_LIST:
             if pattern in block.input.get("command", ""):
                 return "Permission denied by deny list"
-    if block.name in ("write_file", "edit_file"):
+    if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):
             choice = input("   Allow? [y/N] ").strip().lower()

s04_hooks/README.ja.md

@@ -108,7 +108,7 @@ def permission_hook(block):
         for pattern in DENY_LIST:
             if pattern in block.input.get("command", ""):
                 return "Permission denied by deny list"
-    if block.name in ("write_file", "edit_file"):
+    if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):
             choice = input("   Allow? [y/N] ").strip().lower()

s04_hooks/README.md

@@ -108,7 +108,7 @@ def permission_hook(block):
         for pattern in DENY_LIST:
             if pattern in block.input.get("command", ""):
                 return "Permission denied by deny list"
-    if block.name in ("write_file", "edit_file"):
+    if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):
             choice = input("   Allow? [y/N] ").strip().lower()

s04_hooks/code.py

@@ -75,17 +75,9 @@ SYSTEM = f"You are a coding agent at {WORKDIR}. Use tools to solve tasks. Act, d
 
 
 # ═══════════════════════════════════════════════════════════
-#  FROM s02-s03 (unchanged): Tool Implementations
+#  FROM s02-s03 : Tool Implementations
 # ═══════════════════════════════════════════════════════════
 
-def safe_path(p: str) -> Path:
-    """Convert a string path to a resolved Path relative to WORKDIR.
-    
-    NOTE: Path escape checking is now handled by permission_hook,
-    which asks the user for approval. safe_path only does str→Path conversion.
-    """
-    return (WORKDIR / p).resolve()
-
 def run_bash(command: str) -> str:
     try:
         r = subprocess.run(command, shell=True, cwd=WORKDIR,