Skip stale unrelated allowed roots in Runner cwd checks

[Solaris-star]

Summary

• skip configured allowed roots that cannot currently be canonicalized
• continue checking later valid roots instead of failing unrelated projects
• preserve fail-closed behavior when no valid root matches

Problem

A deleted, moved, or temporarily unavailable entry in policy.allowed_roots currently makes cwd_allowed return before checking later roots. This can block every project routed through the Runner even when the requested cwd is under a different valid root.

This matches the existing behavior in validate_project_path_policy, which already ignores roots that cannot be canonicalized and still denies when no valid root matches.

Tests

• cargo test --locked -p webcodex-runner cwd_allowed_ -- --nocapture
• cargo fmt --all -- --check
• cargo check --locked -p webcodex-runner

[yyjeqhc]

Reviewed the Runner cwd boundary change. The bug is real: cwd_allowed currently returns on the first allowed_roots canonicalization error, so one deleted/unavailable unrelated root can block later valid roots. This change preserves union-of-roots authorization semantics by ignoring roots that cannot currently authorize anything, while still canonicalizing the requested cwd and denying when no valid root contains it. It also aligns execution-time cwd checks with the existing project-path policy adapter, which already filters unusable roots. The focused regressions cover the stale-root-before-valid-root case and fail-closed no-match behavior. No correctness or authority blocker found; CI is still pending/awaiting execution for this fork PR.

[yyjeqhc]

LGTM. Thanks!