Add default folders for new Cowork sessions

[zhouzhuozhzh-maker]

Problem

Folder grants are currently session-scoped, so people who use the same working directories across conversations must add them again every time. There is no account-level starting set, even though each session already owns a persisted read-only/read-write root snapshot.

Solution

• add an optional default_roots preference and a validated REST setter that canonicalizes directories, deduplicates aliases, and preserves read-only/read-write access
• copy existing defaults into newly built multi-root Cowork sessions while leaving every existing session snapshot unchanged
• preserve per-session add, toggle, remove, restart, and pre-first-turn behavior for inherited folders
• add a Default folders editor to Settings > General > Files using the existing folder picker and root access controls

Why this approach

The session root list remains the permission owner. Account defaults are copied only when a session has no persisted record; they are not a live global grant. This prevents a later Settings change from silently expanding an existing conversation. Missing configured paths stay visible in Settings but are not granted to new engines.

Code/project sessions retain their existing explicit-workspace boundary; the defaults apply to the multi-root Cowork surfaces that expose additional folders.

Verification

• .venv/bin/pytest tests/test_multiroot.py tests/test_settings.py -q — 21 passed
• .venv/bin/pytest -q — 1174 passed, 1 skipped
• npm test in surfaces/gui — 111 passed
• npm run e2e in surfaces/gui — 168 passed
• npm run build in surfaces/gui — production build passed
• git diff --check — clean

Risk and compatibility

No persisted session or database migration is required. Older prefs without default_roots resolve to an empty list. Existing sessions retain their stored roots, and invalid or missing directories are never added to a new engine.

Screenshot

Fixes #437