fix(host,client): gate the picker affordance on the advertised kind; reject non-absolute browse paths

ds-review-bot round 2. The workspace UI never consulted the advertised
directoryPicker kind: under a browse (or merge-added) backend it still
rendered 'Open local folder…' and called pickDirectory(), which the host
answers with directory-picker-unavailable. The create flow now reads
directoryPickerKind() per menu open and renders the dialog affordance only
under 'dialog' — browse (until its in-app browser UI lands) and unknown
kinds hide the entry, realizing the seam's documented default; a keyless
workspace-flow snapshot pins the hidden entry over the browse fixture.

The browse backend also resolved wire paths, silently rebasing '' or
relative parents under the host process cwd; both primitives now reject
non-absolute explicit paths with their business codes, and the seam JSDoc
carries the contract.

packages/host/directory-picker-browse/tests/service.spec.ts

@@ -70,6 +70,19 @@ describe('BrowseDirectoryPicker', () => {
     expect((failure as DirectoryPickerError).path).toBe(missing)
   })
 
+  it('rejects non-absolute paths instead of rebasing them under the process cwd', async () => {
+    for (const relative of ['', 'projects', './projects', '..']) {
+      const listFailure = await capability.list(relative).catch((error: unknown) => error)
+      expect(listFailure).toBeInstanceOf(DirectoryPickerError)
+      expect((listFailure as DirectoryPickerError).code).toBe('directory-unreadable')
+      expect((listFailure as DirectoryPickerError).path).toBe(relative)
+      const createFailure = await capability.createDirectory(relative, 'child').catch((error: unknown) => error)
+      expect(createFailure).toBeInstanceOf(DirectoryPickerError)
+      expect((createFailure as DirectoryPickerError).code).toBe('directory-create-failed')
+      expect((createFailure as DirectoryPickerError).path).toBe(relative)
+    }
+  })
+
   it('creates one child directory and surfaces it in the next listing', async () => {
     const created = await capability.createDirectory(root, 'fresh')
     expect(created).toBe(join(root, 'fresh'))