feat(mcp): support workspace-scoped stdio cwd

[richuV]

Part of #2140.

Summary

• add optional working-directory support to Core stdio MCP transport using the SDK's protected ProcessBuilder factory seam
• add workspace-relative cwd to Harness MCP server config
• resolve cwd through WorkspaceManager policy and reject absolute/path-escape values
• preserve host-cwd inheritance when cwd is omitted

Verification

• Core/Harness focused MCP/config tests pass; Harness 18/18
• JCode real stdio fixture 1/1 observes the configured Harness workspace cwd

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

u010143241 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

❌ Patch coverage is 53.65854% with 19 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...tscope/harness/agent/tools/McpServerRegistrar.java	50.00%	10 Missing and 1 partial ⚠️
.../io/agentscope/core/tool/mcp/McpClientBuilder.java	42.85%	7 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[AgentScopeJavaBot]

🤖 AI Review

This PR adds workspace-scoped cwd (working directory) support to MCP stdio transport as part of #2140. The change spans three layers: Core (McpClientBuilder adds a stdioTransport overload with Path workingDirectory), Harness (McpServerConfig adds a cwd JSON field; McpServerRegistrar.resolveStdioWorkingDirectory() enforces path safety — rejecting absolute paths and ../ escapes), and tests. The design is sound, security checks are in place, and cwd omission preserves host-cwd inheritance behavior. No blocking issues found.

(inline comments could not be attached — line numbers fell outside PR hunks. See archived report.)