Fixes projects opened at Linux bind-mount targets (like a dev container's /workspace) being refused as too broad, restoring watching, indexing, and search.
Bind-mount roots that expose a subdirectory are judged against the volume containing the mount point, using /proc/self/mountinfo parsing; whole-filesystem mounts, btrfs subvolume roots, and unknown or unreadable tables keep the previous broad answer. The table is parsed as bytes so a non-UTF-8 mount name elsewhere cannot hide the entry for the project root.
Adds a Docker e2e test that verifies /workspace is admitted and / is still refused. The test creates its own temporary folder and removes only that folder, never one the caller named.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issues remain.
Summary
Allows Linux bind-mounted project roots such as /workspace to be watched and indexed while keeping whole-filesystem roots broad.
Linux bind-mounted project roots can start watching and indexing.
