cf856742b1
computeToolPreview/readFileIfExists resolved relative file_write/file_edit paths against the daemon CWD, so the diff shown to the operator for approval read the wrong file (or nothing) when server CWD != workspace_root. Thread the bound workspaceRoot (effectives.policy.workspaceRoot) through and resolve relative paths against it, same as the tools do.