fix(fs): resolve paths against the caller's session cwd

The ACP bridge gives each session its own workspace (SessionHeader.cwd), and
dsh-tool-bash already resolves a bash workdir against it. But ctx.fs.resolve(path)
took no caller context and dsh-fs-local resolved every relative path against a
fixed config.cwd (process.cwd() at plugin load) — so in the ACP demo `write
foo.txt` and `bash cat foo.txt` hit different directories the moment an editor
opens any project other than the server's launch dir.

Thread the session cwd into resolution, mirroring dsh-tool-bash: widen
FileSystem.resolve to resolve(path, opts?: { cwd?: string }); dsh-fs-local bases
a relative path on opts.cwd ?? config.cwd (absolute paths ignore it); the
read/write/edit tools derive it via a shared sessionCwd(exec) helper
(exec.agent?.session.header.cwd). The provider stays free of dsh-agent/dsh-session
— the tool projects exec → cwd and hands over a plain string, per the
explicit-at-seams convention. Backward compatible (the arg is optional).

Tests: fs-local resolve(path,{cwd}) bases relative on the passed cwd / ignores it
for absolute; tool integration writes/reads/edits in a session cwd != config.cwd
and verifies the file on disk (proven to fail on the pre-fix no-cwd path). Fakes
that stood in a bare {session:{}} now carry a header so sessionCwd doesn't throw.
RFC in docs/rfc/implemented/architecture/2026-07-02-fs-per-session-cwd.md.

packages/fs/fs/README.md

@@ -19,7 +19,7 @@ A backend subclasses `FileSystem` and implements six primitives.
 
 | Member | Semantics |
 |---|---|
-| `resolve(path)` | Resolve a path into a stable `FsTarget` (`inputPath`, opaque `targetKey`, `displayPath`). Async — a remote backend may need I/O. The same file via different paths must yield the same `targetKey`. |
+| `resolve(path, opts?)` | Resolve a path into a stable `FsTarget` (`inputPath`, opaque `targetKey`, `displayPath`). `opts.cwd` is the base a relative `path` resolves against (a caller supplies its session workspace; absolute paths ignore it; omitted ⇒ the backend default). Async — a remote backend may need I/O. The same file via different paths must yield the same `targetKey`. |
 | `stat(target, signal?)` | Return `FsInfo` metadata (`version`, `type`, optional `size`), or `undefined` when the target is absent. Never content. |
 | `readText(target, signal?)` | Read the whole regular text file as one decoded string. Owns regular-file checks, UTF-8 decoding, binary/NUL rejection (`FS_NOT_TEXT`). |
 | `streamText(target, signal?)` | Stream the same text as decoded chunks for large files (cross-chunk UTF-8 decoding stays here). |

packages/fs/fs/src/index.ts

@@ -165,8 +165,16 @@ export abstract class FileSystem extends Service {
    * perform I/O (a remote/sandboxed backend may need a round-trip to map a path
    * to a stable identity), hence async even though the local backend only
    * normalizes + realpaths.
+   *
+   * `opts.cwd` is the base directory a RELATIVE `path` resolves against; an
+   * absolute `path` ignores it. Omitted ⇒ the backend's own default base (the
+   * local backend uses its configured `cwd`). The CALLER supplies this — the
+   * seam does not read a session or agent — so a tool can resolve against the
+   * caller's per-session workspace (`exec.agent.session.header.cwd`) without the
+   * provider depending on `dsh-agent`/`dsh-session`. Mirrors how `dsh-tool-bash`
+   * defaults a bash `workdir` to the session cwd.
    */
-  abstract resolve(path: string): Promise<FsTarget>
+  abstract resolve(path: string, opts?: { cwd?: string }): Promise<FsTarget>
 
   /** Return target metadata, or `undefined` when the target does not exist. */
   abstract stat(target: FsTarget, signal?: AbortSignal): Promise<FsInfo | undefined>