feat: SPEC-6-5 cwd isolation (#20) — foreground cwd + userMemory opt-in

[rz1989s]

What

Foreground cwd isolation for the subagent tool — the #20 confabulation fix. A dispatch can now target a working directory (cwd), and the child's working dir + context (AGENTS.md cascade, skill discovery, memory scopes) are scoped to it instead of always inheriting the session cwd. Also makes the global cross-project user-memory scope opt-in (userMemory: true, default off) — it was a cross-project memory bleed by construction.

subagent({ agent, task, cwd: "~/local-dev/getpipher/armory-fleet" })
  → child runs + reads context in the dispatch target, not the session cwd
  → widget shows ↗armory-fleet (cross-cwd glyph) + a spawn-time notify

The end-to-end chain

layer	change
tool (src/tools/subagent.ts)	cwd? param; resolveDispatchCwd (relative → resolve against session cwd; exists + is-dir validation, actionable error); cross-cwd onNotify; threaded to direct/retry/lifecycle-adapter spawnSubagent calls; entryCwd: resolvedCwd → runLifecycle
engine (src/engine/spawnSubagent.ts)	childCwd = opts.cwd ?? opts.parentCwd threaded to RunRecord.cwd, factory.create, run:meta (+ sessionCwd: parentCwd audit on both)
lifecycle (run-lifecycle.ts, registry.ts, lifecycle-types.ts)	per-lifecycle cwd? frontmatter field; precedence lifecycle.cwd ?? entryCwd; PhaseSpawnOpts.cwd threaded to each phase spawn
panel (fleet-panel.ts)	Run-action 3rd cwd input step (prefilled session cwd; Enter accepts, Escape cancels); validation + cross-cwd notify + entryCwd threading
widget (widget-rows.ts)	↗<basename> glyph on cross-cwd fg runs
memory (child-loader.ts, port.ts, adapter.ts, claude-factory.ts)	memoryScopesFor(cwd, { includeUser }); user? optional; adapter null-guards; both backends pass includeUser: agent.userMemory ?? false
registry (frontmatter.ts)	userMemory: boolean (default false)

Breaking changes (migration notes in README)

1. userMemory default flip — the user pseudo-scope (/__armory-fleet-user__) is no longer hydrated by default. Add userMemory: true to opt back in. TS consumers constructing AgentDef literals must include userMemory (required field).
2. AgentDef.userMemory required — compile-time break for external TS constructors of AgentDef.

Deferred (tracked)

• T6 — bg/scheduled + worktree cwd-isolation (SPEC-6-5 tail: bg/scheduled + worktree cwd-isolation (foreground cwd shipped; bg deferred) #62): the cwd param is honored by foreground dispatches only for now. The WorktreeService is session-scoped (rootDir: ctx.cwd) and the bg path doesn't receive cwd yet. Rare intersection (cross-cwd × bg × worktree); documented in README.

Verification

• pnpm typecheck clean; pnpm test:run 699/699 (677 → 699, +22).
• 8 per-task read-only reviews (all Approved) + a final whole-branch review: Ship — "the cwd threading chain is coherent end-to-end... ready for v0.13.0 release."
• Executed via subagent-driven development (dogfooding the fleet to build the fleet); 5 dogfood findings filed during the build: subagent: model param constrained to session enabledModels; error doesn't list available models #57, subagent: defaultModelFallback unset by default — provider rate-limits fail the dispatch with no auto-retry #58, subagent: explicit model string fails where inherited session model succeeds (same model) #59, #49 regression: filesTouched empty on real edit-tool runs — args serialized as empty, run:ended missing the field #60, panel: Input onEscape callbacks are dead code — handleInput intercepts Escape before the Input fires #63.

Closes #20 (foreground cwd isolation; bg/worktree follow-up → #62; SPEC-6-4 keeps event-bus RPC + live conversation viewer).