refactor(agent): unify effective run cwd

[jomeswang]

What changed

• Remove workspace-root fallback and template exports.
• Compute one effectiveRunCwd for detection, composer options, skills, execution, compaction, environment, and session permissions.
• Keep participant persistence as an additional allowed directory only.
• Add standalone and managed cwd regression tests.

Why

Managed runs previously detected an Agent in one directory and launched it in another, which caused capability and file permission mismatches.

Risks

Callers can no longer steer execution through GROUP_CHAT_WORKSPACE aliases.

Verification

• typecheck
• 10 focused effective-cwd and package tests
• actual Tutti package build
• git diff --check

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.