Summary

• scope VS Code MCP launch config to ${workspaceFolder}
• launch the dashboard with the active workspace project root
• reject WSL-mounted Windows user profile roots as broad/unsafe fallbacks
• guard markerless MCP root derivation against broad roots

Fixes #1270

Validation

• git diff --check -- touched files
• cargo fmt --check
• npm run compile

Note: local cargo test --lib was attempted, but the full Rust lib test run exceeded the interactive window in this environment. CI should provide the full gate result.