fix: make session file roots backend-authoritative, never trust client cwd

[william0wang]

Problem

The remote file browser sometimes rooted a session at the filesystem
root (/) instead of the project directory — reproducibly once two
sessions were active (session switching races the App's 4s instance-list
poll).

Root cause chain (verified live — a hub instance was advertising
workspace: "/"):

1. The App derives session/load's cwd from the hub instance list and
   fell back to "/" whenever that list was stale;
2. the bridge's loadSession/resumeSession blindly recorded the
   client's cwd into sessionCwds — the value the /fs endpoint scopes
   file access to;
3. projectCwd() returned the first sessionCwds entry, so one
   polluted "/" hijacked the instance's advertised workspace and every
   later remote load inherited it.

Fix — the client no longer decides the file scope

• Backend-authoritative roots: session/load·resume ignore the
  client cwd. The root comes from what the bridge recorded at creation,
  corrected by the backend's own session/resume result
  (session.workspace.workspacePath). This also self-heals
  previously-polluted entries on the next load.
• Client cwd only at creation: session/new still trusts the editor's
  worktree (creation semantics); "/" is rejected everywhere as a
  degenerate root.
• /fs defense in depth: a session whose recorded root is "/" (before
  or after realpath) is refused with 403 — a polluted record can never
  widen remote access to the whole filesystem.
• projectCwd(): most-recently-active session's cwd, skipping "/"
  entries — the advertised workspace can no longer be poisoned by one
  bad entry.

Companion App fix (zcode-acp-app): stop sending the "/" fallback — omit
cwd when the instance list doesn't know the instance.

Testing

• tests/session-cwd.test.ts (9 cases): client cwd ignored (even
  plausible paths), backend workspace adoption, polluted-entry healing,
  already-live root retention, creation-time cwd guard, projectCwd
  recency + "/" skipping.
• /fs root-"/" refusal case in tests/remote-file-endpoint.test.ts.
• Full suite: 688/688 passed; typecheck/lint/build clean.
• Version 0.11.4 + CHANGELOG.