MCP: ui.menu.list leaves out recent files outside the read roots

Under --automation-read-root, a control client's ui.menu.list (and
ui.contextMenu.list, which shares the listing) left every File › Open
Recent Files row in, so the client saw the names of recent files it may
not read. file.recentFiles returned their full paths, and
file.openRecentN for such a file answered with a refusal naming the path.

Now the listing leaves out a recent file outside the read roots, as it
already leaves out listed scripts outside them. The other rows keep their
ids, so file.openRecent3 still opens the third file. file.recentFiles
returns only the files inside the roots, in order, and file.openRecentN
for a file outside them ends with "no such recent file", as an empty slot
does. The person's own menus and Home screen are unchanged.

Docs: docs/mcp.md, docs/control-protocol.md, docs/target-app-parity.md.

docs/control-protocol.md

@@ -691,7 +691,8 @@ In the desktop app a Paste from the menus or the keys (`ui.key`) decodes a bitma
 `edit.paste*` reads it at once.
 
 File menu details: `file.openRecent1`…`file.openRecent30` open the recent files the `recentFilesCount` preference
-lists (0 hides them all; `file.recentFiles` returns the listed paths), `file.reveal` shows the document's file in the
+lists (0 hides them all; `file.recentFiles` returns the listed paths; under a read root, `ui.menu.list` and
+`file.recentFiles` leave out the files outside it and `file.openRecentN` answers `no such recent file` for one), `file.reveal` shows the document's file in the
 system file manager (desktop only; answers `{path}`), and `file.newFromTemplate` without params opens a file picker
 in the Templates folder (preference `templatesFolder`). Older native files open as "<name> [Converted]" (preference
 `appendConverted`), so their Save asks for a new `.vectorcraft` name. Native files reopen at the view they were saved