fix(acp): require explicit workspace contract

[kenyip]

Summary

• add an explicit BUZZ_ACP_WORKSPACE / --workspace-root contract for the ACP harness
• require the resolved workspace to be absolute, existing, non-root, and AGENTS.md-bearing
• pass the exact canonical root into ACP session/new.cwd instead of silently substituting /
• preserve setup-listener compatibility by skipping workspace validation when no ACP session is created
• document the configuration and emit the resolved workspace in startup diagnostics

Origin: Buzz #infra channel b4547fd2-961e-4b2a-8c8c-04f8ca904c65, thread 818196b6b3d07356ff80266e75dc97e8f4f40a963348d332be02c682f8549371.

Verification

• cargo fmt --all -- --check — pass
• cargo clippy -p buzz-acp --all-targets -- -D warnings — pass
• cargo test -p buzz-acp — pass: 670 unit + 9 integration
• runtime regression: ambient / fails closed
• fake ACP peer regression: explicit workspace is exactly the session/new.cwd
• setup-listener probe from /tmp without AGENTS.md reaches relay connection rather than failing workspace validation

Known environment gap

Full-repo just ci passed workspace Clippy and desktop JavaScript checks, then stopped in desktop Tauri Clippy because this Linux host lacks GTK/GObject development headers. This is host-only and outside the buzz-acp harness slice; package fmt, warning-free Clippy, and the complete buzz-acp package test suite are green.

[kenyip]

Jarvis quality gate (estate control-plane): GREEN on de88c5eaafb774fb59e0a94536beae1611d4b9bf.

Reviewed the diff for Host ACP workspace correctness:

• Removes silent cwd → / fallback on normal startup and models
• resolve_workspace_root fail-closed: absolute, exists, directory, non-root, AGENTS.md, canonicalize; no root fallback on cwd failure
• Validated root is the exact session/new / pool cwd; startup summary exposes workspace=
• Setup-listener path skips workspace validation (no ACP session) — preserves desktop setup from /tmp
• Package-scoped verification claimed green (fmt, clippy -D warnings, full buzz-acp tests); DCO/zizmor green on this head

Origin: Buzz #infra multi-agent Build 0. Host-edge mitigations already live on our fleet; harness merge is the correctness ship. Not requesting self-merge; needs upstream review.

[kenyip]

Closed per Ken (#infra): public PR under personal kenyip opened without explicit gate. Live Host ACP already hardened locally; upstream not required.