Honor environment-resolved workspace roots (#40912)

## What changed

- Add effective workspace roots to `EnvironmentConfig` and use them when
  materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
  ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
  `apply_patch` writes in owner-provided secondary workspaces.

GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70