Align CLI allowed root authority

[yyjeqhc]

Summary

• make webcodex project register skip stale/unusable allowed_roots candidates instead of letting one unrelated root poison the whole authority set
• centralize usable-root canonicalization in webcodex-runner-config and reuse it from Runner project path validation
• keep fail-closed behavior when no usable root matches, preserve symlink escape rejection, dangerous-root policy, allow_cwd_anywhere, and Windows path fences

Independent review

Reviewed the exact target range 1924286b02bb9c497a16b75414969f5c3f8ba5e9..a1a6891098c3fa0387eee2ce6e5e94c9df0f72e9. No correctness or authority blocker found.

The local worktree had a later unrelated commit (6369cdc6 Stabilize tunnel startup diagnostics) on top. It is intentionally excluded from this PR; the remote PR branch points exactly at a1a6891098c3fa0387eee2ce6e5e94c9df0f72e9.

Validation

• cargo test -p webcodex-cli webcodex_cli::project::tests — 15 passed, 0 failed
• cargo test -p webcodex-runner project_policy — 7 passed, 0 failed
• cargo check --all-targets -p webcodex-cli — passed
• cargo fmt --all -- --check — passed
• git diff --check 1924286b...a1a68910 — passed
• workspace hygiene — clean; active jobs 0; validation current/pass