Have tools respect private and excluded file settings

[rtfeldman]

Based on a Slack conversation with @notpeter - this prevents secrets in private/excluded files from being sent by the agent to third parties for tools that don't require confirmation.

Of course, the agent can still use the terminal tool or MCP to access these, but those require confirmation before they run (unlike these tools).

This change doesn't seem to cause any trouble for evals:

Release Notes:

• N/A