fix(ws): lazy + memoized session-cwd resolution (host-stats lagging toggle)

[danshapiro]

Summary

Fixes the production host-stats tile toggling to lagging every few seconds.

Root cause: every ~5s auto-title sweep pass called find_all_by_session, which eagerly std::fs::canonicalized every session's cwd (every provider) on every call — including per-terminal comparisons. On WSL2, cwds under 9P-mounted, cloud-sync-backed paths (Google-Drive-synced /mnt/d folders) stall 0.4–2s per resolution, blocking the async runtime and tripping the host-stats drift sampler.

Fix (two layers, matching the Node original's matching semantics):

1. find_all_by_session now resolves the session cwd lazily — only claude-scoped lookups (the only provider that uses cwd matching) ever canonicalize; non-scoped lookups (codex etc.) pay nothing.
2. Both matching sides route through a per-registry memo (normalize_scoped_cwd_cached): each distinct raw cwd string is resolved on disk exactly once per registry lifetime, then served from the map. Lock discipline: the on-disk resolution happens outside the memo lock, so a slow path never holds it.

Matching behavior is unchanged (verified by three independent reviews); the accepted tradeoff — a symlink retarget after first resolution keeps serving the first target for that raw spelling — is documented in port/oracle/DEVIATIONS.md DEV-0021 and pinned by a test.

Evidence

• 9 new tests: 6 unit-level in identity.rs (lazy scoping, memo hit/retarget behavior, empty-cwd pin, contract tests) + 3 sweep-level integration tests in auto_title_sweep.rs driving the real pass with real symlinked directories (claude cwd discrimination between two live terminals, canonical match through symlinks plus second-pass idempotence, codex cwd-blindness). After the rebase onto the unified-agent-names work, the sweep tests assert through the terminal.meta.updated upsert fan-out (scoped sessions' titles now come from the naming authority).
• Gates: vitest cloud 4/4 shards green, source-runtime green; rust stage red only in the pre-existing b46d freshagent fencing family (below).
• cargo fmt --check and clippy clean; freshell-ws 762/762; freshell-server 1159 passed (the one failure is the known tsmx net_bind load flake — passes in isolation).

rust-gate will be red — pre-existing b46d, not this PR

cargo test --workspace is red on main itself in the freshagent kill/handoff fencing family (kata b46d: 4–5 deterministic tests, last edited 2026-09-11, regression window PRs #798–#815, filed and currently unowned). This PR does not touch freshell-freshagent, and that crate is not a dependent of any changed crate, so the red is inherited from base, not caused here. Per the documented merge policy, it merges via the owner-account ruleset bypass.

Docs

• Plan: docs/plans/2026-09-20-cwd-canonicalize-lag.md — the-usual run record: load-bearing validation (9 claims, 4 falsified-and-corrected), plan review PASSED round 1, delta review PASSED round 1, full gates passed under the user's documented b46d waiver.
• port/oracle/DEVIATIONS.md DEV-0021: the KEPT cwd-resolution schedule divergence behind the memo.