feat(drive): expose authorized typed Workspace Drive API

T-722: reuse T-721 storage/CAS/receipts with clone-bound transaction authorization against attached Server authority. Add migration 84 audited Worker read_only/read_write grants and removal/deletion fencing, member-facing ordinary access, owner-controlled grant settings, Workspace-bound decimal entry references, bounded text/binary chunks, streamed HTTP receive/download with integrity and safe headers, typed errors and generated Rust/OpenAPI/TypeScript contracts.

Validation: root cargo check; server-api 83 default / 91 typescript tests; FeatureStorage 16; Drive 31 unit + 12 integration; Workspace Server 691 library + 11 binary tests (--test-threads=4), including 9 real DB/LocalFileSystem HTTP tests for two Workers/non-owner usage, revoke during reception, concurrent CAS, response-loss receipts, chunk expiry and safe binary media. cargo fmt --all -- --check and git diff --check HEAD passed. Existing OpenAPI schemas/routes semantically unchanged; dependent TS digest projections regenerated.

docs/report/t-722-subworker-cwd.md

@@ -0,0 +1,18 @@
+# T-722: SubWorker cwd and logical path friction
+
+During delegation from the assigned repository Workdir, a child started with
+`cwd: crates/server-api` and readable policy paths under repository-root
+`docs/development`. Its Read calls using repository-relative logical paths could
+not read the required testing strategy; absolute paths were rejected as invalid
+logical paths too. The child correctly stopped without edits. The parent
+inspected the committed child session, stopped that idle child, and recreated it
+with repository-root cwd and explicit read-only repository scope plus write scope
+limited to server-api. Policy reads and implementation then succeeded.
+
+The current observable behavior appears to root child filesystem tools at the
+selected cwd, rather than making cwd only the command default as the spawn-tool
+description states. This makes repository-root logical paths surprising. Consider
+keeping the attachment root invariant and applying cwd only to command execution,
+or documenting/returning a distinct filesystem base explicitly. Do not encourage
+absolute paths, parent traversal, or broader write grants as a workaround. This
+report records a tool usability issue, not additional Ticket requirements.