sandboxing: migrate cwd inputs to PathUri

[anp-oai]

Why

Sandbox cwd values can cross app-server and exec-server host boundaries. They should retain URI semantics until the receiving host validates them instead of being interpreted early as native paths.

What

• Carry PathUri through filesystem sandbox contexts, sandbox commands, and transform inputs.
• Convert command and policy cwd once in SandboxManager::transform, then keep launch requests native.
• Preserve sandbox cwd over remote filesystem transport and reject non-native URIs without fallback.
• Cache paired native/URI turn-environment cwd values during migration, with immutable access to keep them synchronized.
• Extend existing protocol, forwarding, transform, and core runtime tests.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9fe5d6d3c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".