Resolve a relative workspace against one anchor for parent and sandboxed child #658

Found in the review of #648 (sandboxed launch).

A workspace path given as a relative path in an agent's config should resolve against one fixed anchor, so the launching process and the sandboxed child agree on it. nono sets the child's working directory to --workdir, so today the two can resolve a relative workspace from different directories.

The fix picks one anchor (the config file's directory, or the launch working directory) and applies it everywhere the workspace is resolved: the agent package's config loader, the child's own config read, and the derived mailDir and memoryPath defaults. It normalizes the workspace to an absolute path once, before launch.

Acceptance: a real-file launch case with a relative workspace, in which the parent and the sandboxed child resolve the same absolute path.