fix(worker): scope the index worker to the request's repository, not the daemon's environment

[DeusData]

Defect

The daemon-spawned index worker inherited the daemon process environment and re-ran the allowed-root check without a session policy.

Trace on main: the daemon's session policy is installed only in src/daemon/application.c (the sole production caller of cbm_mcp_server_set_session_context). After the daemon admits an index_repository request, src/mcp/index_supervisor.c builds the worker argv (cli --index-worker --index-worker-build <fp> index_repository <args_json> --response-out ... - no root anywhere) and src/foundation/subprocess.c spawns it with the daemon's environ. The worker creates its own server with cbm_mcp_server_new(NULL), so handle_index_repository runs with allowed_root_policy_set=false and falls back to getenv("CBM_ALLOWED_ROOT") - the environment of whoever started the daemon (bootstrap.c spawns it with the starter's environ) - and workspace.c refuses containment.

Observed: daemon started with CBM_ALLOWED_ROOT=<rootA>; a client session for <rootB>/tiny is admitted by the daemon (index.supervisor.reap outcome=clean exit_code=0) and then refused by the worker:

<rootB>/tiny is outside the allowed root. To allow it, run: codebase-memory-mcp allow-root <rootB>/tiny

Any daemon whose starter had CBM_ALLOWED_ROOT set broke every other session outside it.

Fix

In the worker arm of run_cli (src/main.c), right after the worker's server is created and before any tool runs, read repo_path from the request args (both daemon spawn paths rewrite the worker args with the canonical repo_path via index_args_with_repo_path), canonicalize it and install it explicitly as both session root and allowed root. The daemon already authorized the request; the worker only executes it.

• A repository that cannot be canonicalized does not exist and can only have been admitted by a session with no declared boundary (containment needs a real path), so the worker mirrors that with an explicit unrestricted policy - still never the environment fallback - and the pipeline keeps reporting the missing repository as the tool error it always was (this keeps the Step 5c contract tests/test_worker_error_response.sh green).
• A request without repo_path fails closed: error: request workspace scope invalid: request names no repo_path, non-zero exit, no response file.
• No argv or IPC change, no process-environment mutation.

Distilled from #1925 with co-author credit to @zhiyuzhang001-a11y (only the defect fix; nothing from the feature). Refs #1925.

Regression test

tests/test_worker_session_scope.sh (Step 5f in scripts/test.sh, mirrored on test_worker_error_response.sh) drives the real binary as a supervised worker with CBM_ALLOWED_ROOT=<rootA> and repo_path=<rootB>/tiny and requires a "status":"indexed" response with no boundary refusal; a second worker without repo_path must exit non-zero on the scope check.

• RED on main (same build, main.c reverted): the worker delivered the exact refusal above (isError:true).
• GREEN with this change.

Verification (macOS, final tree)

• build/c/test-runner index_supervisor daemon_application daemon - 72 passed
• build/c/test-runner mcp cli - 618 passed, 4 SKIP_PLATFORM (Windows-only, pre-existing)
• tests/test_worker_error_response.sh, tests/test_worker_watchdog.sh, tests/test_parent_watchdog.sh - green against the fixed binary
• make -f Makefile.cbm lint-ci - passed; scripts/check-no-test-skips.sh - OK; tests/test_script_exec_bit_contract.sh - PASS
• No raw fopen(, ASCII-only additions, no SKIP()/NOLINT

Note for the queue: this touches scripts/test.sh (CI script) only to add the Step 5f invocation.