fix(desktop): zero-prep connector onboarding (create workspace dirs)

[haowei2000]

Problem

Creating a connector from the desktop New connector flow fails to start with:

Error: daemon exited during startup:
  failed to load config …/cheers-daemon.<bot>.toml
Caused by:
  accounts.<bot>.policy.workspace.allowed_roots does not exist: ~/.cheers/workspace/<bot>
  No such file or directory (os error 2)

The gateway's generated config points policy.workspace.allowed_roots (and default_cwd) at ~/.cheers/workspace/<bot>, and the connector validates those dirs exist at startup (resolve_existing_dirs) — but nothing creates them. So onboarding from the desktop needed manual mkdir prep, which defeats the point of one-click "Set up & start".

Fix

connector_write_onboarded now creates the referenced workspace directories right after writing the config (the desktop is on the same machine and owns ~/.cheers). It is:

• Best-effort — a dir that genuinely can't be created just resurfaces the connector's own clear startup error.
• Scoped to the user's home dir — a gateway-supplied config must not be able to make the app mkdir -p arbitrary system paths.

The home-scoping/collection logic is factored into a pure workspace_dirs_in_config() with unit tests (home-scoped kept, out-of-home dropped, malformed TOML → empty).

Verify

cargo test (2 new tests pass) · cargo fmt --check clean. Full end-to-end (retry New connector → daemon starts) needs a rebuilt .app — flagged for live verification.