fix: refresh routed workspace explorer trees

[overact]

Summary

• route Better Sidebar Explorer directory listings through the DSH filesystem service
• preserve the session anchor path in client rows while containment uses provider-owned target identities
• add SSH-anchor, local-security, symlink, and plugin-shape regression coverage

Diagnosis

SSH Remote workspaces use empty local anchor directories whose descendants are projected by the routed ctx.fs service. Better Sidebar cleared its client cache correctly on refresh, but its host fs.tree route re-read the empty anchor with Node opendir, so every refresh returned an empty tree.

Verification

• pnpm exec vitest run tests/fs-tree-routed.spec.ts tests/fs-tree.spec.ts tests/fs-tree-symlink.spec.ts tests/plugin-shape.spec.ts
• focused tests/smoke.spec.ts SSH/tree/fence cases
• pnpm typecheck
• pnpm build

Scope

This fixes Explorer listing/refresh for routed workspaces. Other Better Sidebar surfaces that still use direct Node filesystem/process APIs (read/write/search/upload/Git/terminal) need separate routing work.