fix(core): fall back from protected local launch directories

[knqiufan]

Summary

Starting a local surface from Raven's instance directory or Agent home previously made that directory the turn's working directory without validating it. Checkpoints could store provider credentials, OAuth tokens, memory, transcripts, and rendered agent configs; command diffs could also report the conversation's own transcript.

• Validate the launch directory through the existing working-directory boundary. Protected launches warn and fall back to the gateway's per-channel temporary root.
• Preserve valid project launches, the user-home/ancestor exception already protected by CheckpointService, explicit and session overrides, and the original project grouping. Sandbox mounts follow the selected policy.
• Add 16 assembly cases and two real-git/command-diff regressions. Make test-home isolation work on Windows and mark two POSIX-only checkpoint tests accordingly. Update the English and Chinese usage guides and the runtime context.

This covers local surfaces sharing build_local_sessions, including a WebUI process that falls back to standalone serve.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• uv run pytest tests/test_core_engine_stack.py tests/test_agent_workdir.py tests/test_runtime_checkpoint.py tests/test_cli_a2a_commands.py tests/test_rpc_bootstrap.py -q -n 4 --tb=short --cov=raven.core.engine_stack --cov-branch --cov-report=term-missing --cov-report=json: 123 passed, 2 POSIX-only tests skipped on Windows.

• uv run python scripts/coverage_gate.py diff --base-ref origin/main --threshold 90: 100% of 16 changed executable lines covered. Windows coverage path separators were normalized before the gate.

• uv run ruff check raven evolver agents plugins-dist tests scripts docs-site: passed.

• uv run ruff format --check raven evolver agents plugins-dist tests scripts docs-site: passed, 2162 files formatted.

• uv run ty check raven/core/engine_stack.py: passed.

• uv run lint-imports: all 10 contracts kept.

• uv run python scripts/check_large_files.py origin/main, uv run python scripts/check_source_language.py origin/main, and git diff --cached --check: passed.

• uv run pre-commit run --files CONTEXT.md docs-site/docs/using-raven.md docs-site/docs/using-raven.zh.md raven/core/engine_stack.py tests/conftest.py tests/test_core_engine_stack.py tests/test_runtime_checkpoint.py: all applicable hooks passed.

• Ten new regression cases failed against the original implementation before the fix.

• make ci is unavailable on this Windows host without make or WSL; the relevant Makefile checks were run directly as listed above.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

Risk

A local surface launched from a protected runtime directory now works in a per-channel temporary directory and emits a warning. Valid project launches and validated overrides keep their existing behavior.

Previously created shadow histories remain on disk and require separate cleanup; credentials exposed by an earlier snapshot require rotation. Reverting the squash commit restores the previous directory selection and reintroduces the unsafe launch behavior.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

Fixes #850