feat(web): open a produced file from the conversation

Serve one file at a time out of a Session's workspace under /f on the web
transport, and point the conversation's existing file-open affordance at it.
Clicking a write/edit/read row's path now opens that file in a browser tab —
including from a LAN client, where the Host's system opener is fenced to
loopback and answered nothing.

- /f/<sessionId>/<segments> in client-connection, behind the same
  browser-trust fence as /api; realpath confinement, streamed reads,
  GET/HEAD only, nosniff + no-store.
- Script-capable documents carry CSP sandbox: model-authored markup must not
  be same-origin with /api, where events.mux is a readable GET stream.
- ApiProxy.workspaceRootOf answers where a Session's files live without
  resuming an agent; the client program cannot reach the core services.
- The /f URL shape lives in dsh-host-apiproxy/api so both ends share one
  encoding (client bundles may not value-import another plugin).

packages/client/ui-conversation/src/client/apply.ts

@@ -275,6 +275,15 @@ export function apply(ctx: Context): void {
         },
         openFile: (path) => {
           const cwd = sessions.list.getSnapshot().byId[sessionId]?.cwd
+          // A file inside the workspace opens in a new tab, so a browser that
+          // is not on the Host machine can still see what the agent produced.
+          // Anything outside it has no served URL and falls back to the Host's
+          // own opener, which is loopback-only by the /api trust fence.
+          const url = workspaces.fileUrl(sessionId, cwd, path)
+          if (url !== undefined) {
+            window.open(url, '_blank', 'noopener,noreferrer')
+            return
+          }
           void workspaces.openPath(resolveToolPath(cwd, path)).catch(() => {
             // Host/OS open failures stay silent in the chat row; the native
             // app surfaces its own error dialog when the path is unusable.