fix: address review bot feedback on concurrency and error handling

- Reverted the 'isIdle' guard in AppContainer.tsx to ensure slash commands entered while the agent is busy are correctly processed or queued, preventing them from falling through as regular chat text.
- Enhanced the physical path validation in config.ts to gracefully handle 'mkdirSync' failures (e.g. EACCES). The CLI will now log a warning and return the lexically-validated path instead of throwing a misleading 'Security violation' via 'resolveToRealPath'.

packages/cli/src/ui/AppContainer.tsx

@@ -1366,7 +1366,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       }
 
       const isMcpOrConfigReady = isConfigInitialized && isMcpReady;
-      if (isIdle && ((isSlash && isConfigInitialized) || isMcpOrConfigReady)) {
+      if ((isSlash && isConfigInitialized) || (isIdle && isMcpOrConfigReady)) {
         if (!isSlash) {
           const permissions = await checkPermissions(submittedValue, config);
           if (permissions.length > 0) {

packages/core/src/config/config.ts

@@ -2305,6 +2305,18 @@ export class Config implements McpContext, AgentLoopContext {
       try {
         realPlansDir = resolveToRealPath(plansDir);
       } catch (e: unknown) {
+        if (mkdirError) {
+          const errorMessage =
+            mkdirError instanceof Error
+              ? mkdirError.message
+              : String(mkdirError);
+          // eslint-disable-next-line no-console
+          console.warn(
+            `Failed to initialize active plan directory at '${plansDir}': ${errorMessage}`,
+          );
+          this.initializedPlanDirs.add(plansDir);
+          return plansDir;
+        }
         throw new SecurityError(
           `Security violation: Could not securely resolve plan directory '${plansDir}'. System error: ${e instanceof Error ? e.message : String(e)}`,
         );