Fix artifact previews across granted roots

[kudala-bharani]

Fixes #223

What changed

• Discover produced artifacts in every writable directory granted to a session, including roots added while the session is running.
• Resolve preview and reveal requests against all granted roots while retaining path-confinement and symlink-escape protections.
• Give artifacts outside the primary workspace unambiguous absolute API identifiers.
• Decode URL-encoded Unicode artifact links and normalize POSIX/Windows paths before matching them in the GUI.
• Add backend and frontend regression coverage for external roots, read-only roots, Unicode names, live root grants, and path escapes.

Why

Markdown artifact links could point to files the session was allowed to create, but the artifact API only searched the primary workspace. URL-encoded filenames could also fail to match the artifact list in the GUI.

Impact

Links such as artifact:新闻摘要.md now open the preview when the file lives in a granted writable directory. Files in explicitly granted read-only directories remain previewable by absolute path but are not presented as produced artifacts.

Root cause

Artifact discovery and path resolution used a single workspace root instead of the session's live multi-root grant set. The GUI compared raw link paths without first decoding URL-encoded Unicode characters or normalizing path separators.

Validation

• pytest -q — 890 passed, 1 skipped
• NODE_OPTIONS=--no-experimental-webstorage ./node_modules/.bin/vitest run — 72 passed
• npm run build — passed
• tsc --noEmit — passed
• git diff --check — passed