See current-turn edits in the snapshot's pending-change guard

Most agents emit no per-tool file events, so FilesTouched stays empty until SaveStep at turn end. An agent that edited a file and then ran checkpoint create in the same turn got past the refusal. Use resolveFilesTouched under the lock, which falls back to the live transcript; it drops paths outside the worktree, so planning sessions writing plan files elsewhere are still allowed.

Edits made through a shell command remain invisible until turn end; documented as a known limitation rather than closed.