Simplify root-scoped cleanup

docs/internal/workspace.md

@@ -14,8 +14,8 @@ path model, and layout creation goes through `EnsureLayoutFor`. Callers should
 consume those helpers instead of rebuilding relative paths.
 
 `internal/pathsafe` validates relative destinations. `internal/fileops` opens
-cleanup roots and their descendants through no-follow directory handles before
-removing them.
+explicit cleanup roots and removes only normalized proper descendants through
+the resulting root handle.
 
 `internal/fileops` owns the ordinary workspace mode contract. On POSIX,
 `WorkspaceDirectoryMode` is setgid `02775` and `WorkspaceFileMode` is `0664`.
@@ -60,8 +60,7 @@ Automatic post-publish cleanup:
   key in publish metadata;
 - consumes the resolved cleanup policy described in
   [Configuration](../config.md);
-- refuses unsafe deletes (root delete, out-of-root delete, and symlinked
-  ancestors or entries);
+- refuses unsafe deletes (root delete, traversal, and out-of-root targets);
 - retries any recorded incomplete target on later invocations even when no
   publish work is selected. Missing targets are a successful, idempotent
   cleanup result only after the completion evidence is saved.