fix: hide unstable BYO directory activation

[baixiaohang]

Summary

• make BYO Context setup choices depend on whether the provider exposes a stable directory
• hide directory activation for pathless sessions, Codex Documents scratch paths, and default Codex managed worktrees while preserving their canonical project identity
• use only CLAUDE_PROJECT_DIR (or explicit --project-root) for Claude setup directory availability
• let the BYO reader skip Context Tree selection when every readable SCOPE is clearly unrelated, while preserving fail-closed ambiguity and availability boundaries
• align the committed cross-surface QA cases with the dynamic choices and tri-state reader contract

This implements the agreed resolution for #2209 without introducing a git-project scope or changing the v3 grant schema. It replaces the issue's original Git identity proposal with a narrower setup-only rule that omits a misleading directory choice when the current path is not stable across sessions.

Safety boundaries

• Hooks and runtime route/status/disable/handoff identity are unchanged.
• Existing directory grants and grant precedence are unchanged.
• selectionBlocked, unavailable candidates, overlapping/unclear SCOPE files, exact snapshot selection, and BYO Write confirmation remain fail closed.
• Custom Codex App worktree roots remain best-effort until Codex exposes a stable public setting.

Validation

• pnpm --filter first-tree-dev exec vitest run src/__tests__/context-project-resolver.test.ts src/__tests__/context-enable-command.test.ts --maxWorkers=2
• pnpm --filter @first-tree/skill-evals exec vitest run src/suites/first-tree-read/__tests__/floor.test.ts --maxWorkers=2
• pnpm --filter @first-tree/skill-evals eval:floor (8/8 deterministic floors)
• pnpm --filter @first-tree/qa exec vitest run --passWithNoTests --maxWorkers=2
• pnpm check && pnpm typecheck
• umask 0022 && pnpm exec turbo run test --concurrency=1 -- --maxWorkers=2 (12/12 workspaces)

The host defaults to umask 0002, which caused the first full client test run to create fixture directories with group-write permissions and fail four managed-skill permission assertions. Re-running the unchanged tree under the standard umask 0022 passed all 2,417 client tests and the complete monorepo suite.

Coordination

PR #2207 independently changes Context enable preflight and overlaps enable.ts, its tests, and the two Context integration documents. This branch does not merge or rebase that work; whichever PR lands second may need a small semantic integration of both changes.

Closes #2209

[yuezengwu]

这项改动的目标是避免在 provider 无法提供跨 session 稳定目录时暴露误导性的 BYO directory activation，同时让 first-tree-read 在所有可读 SCOPE 都明确无关时直接继续原任务。

核心改动：

• setup location 新增稳定目录可用性判定；pathless、Codex Documents scratch path、默认 Codex managed worktree 仅返回 global/session choice，同时保留 canonical project identity。
• directory availability 纳入 plan identity；隐藏 scope 没有 after-fingerprint/apply command，手工构造的 directory apply 也会 fail closed。
• Claude setup 只采用 CLAUDE_PROJECT_DIR 或显式 project-root；Read skill 增加 all-clearly-unrelated 分支，但 unavailable、overlap、unclear、selectionBlocked 与 exact snapshot 边界保持 fail closed。
• 文档、floor contract 与跨 surface QA case 同步到动态 choice 和 tri-state reader 语义。

我检查了 location classifier、plan/apply 校验、既有 grant 优先级、SCOPE selection 分支和相关文档/测试 diff，没有发现 blocker。该 PR 不涉及核心数据结构、v3 grant schema 或数据库变更；按 review 要求未额外运行测试或 QA。

非阻塞后续：现有 Context Tree 的 External BYO 节点仍描述“临时目录保留 directory choice 并警告”的旧决策，源码合并后应通过 source-backed Tree change 同步；PR #2207 若后合并，也需按描述整合 enable.ts 与文档的重叠改动。