MCP: a path into a missing folder inside an allowed one says the folder is missing (#1082)

PathScope::check reports a missing folder inside the scope as NotFound with the nearest existing folder, instead of calling it outside the allowed folders. Paths outside the scope and dangling links are still refused. Fixes #1077.

docs/mcp.md

@@ -49,7 +49,7 @@ start-up and says when the `--in` design's folder was left out; `--allow-path` a
 
 Paths are resolved before they are compared, so `..` and symlinks that lead out are refused
 (saving through a link writes the file it points to, so the link's target is what counts), and
-a new file must go into a folder that exists. On Windows a path must be on a local drive
+a new file must go into a folder that exists (a missing folder inside an allowed one is reported as missing; it is not created and does not call for a wider `--allow-path`). On Windows a path must be on a local drive
 (`C:\…` or `\\?\C:\…`): UNC, device and NT paths in any spelling (`\\server\share`,
 `//server/share`, `\\?\UNC\…`, `\??\…`, `\\.\…`), drive-relative paths (`C:file`), a `:` in a
 file name (alternate data streams), reserved device names with any extension (`NUL`, `CON`,