Propagate workspace roots to exec-server sandboxes

[copyberry]

Propagate workspace roots to exec-server sandboxes

What changed

• Pass configured workspace roots from core to the exec server so filesystem and process sandbox permissions are materialized against the intended roots.
• Preserve an explicitly empty workspace-root list instead of treating the sandbox working directory as an implicit root.
• Initialize filesystem sandbox contexts with their working directory as the default workspace root.

Testing

• Add end-to-end coverage for patch and command writes inside and outside workspace roots.
• Verify remote filesystem and process sandboxes do not grant access through an empty workspace-root list.