fix: prevent SSE event cross-workspace leakage

- Register session cwd before publishing created event (was async void,
  causing cwd to be undefined during event dispatch)
- Fix EventBus cwd filter: skip events when sessionCwd is undefined
  instead of allowing them through unfiltered

Co-Authored-By: claude-sonnet-4-6 <noreply@anthropic.com>

src/server/eventBus.ts

@@ -74,7 +74,7 @@ export class EventBus {
           const sid = dataObj?.session_id ?? dataObj?.sessionID
           if (typeof sid === 'string') {
             const sessionCwd = this.sessionCwds.get(sid)
-            if (sessionCwd && sessionCwd !== client.cwdFilter) {
+            if (sessionCwd !== client.cwdFilter) {
               continue
             }
           }

src/server/sessionManager.ts

@@ -237,9 +237,8 @@ export class SessionManager {
 
     this.sessions.set(sessionId, handle)
     if (!opts.silent) {
-      void canonicalizePath(cwd).then(canonical => {
-        this.eventBus.registerSessionCwd(sessionId, canonical)
-      })
+      const canonical = await canonicalizePath(cwd).catch(() => cwd)
+      this.eventBus.registerSessionCwd(sessionId, canonical)
       this.eventBus.publishSessionEvent(sessionId, 'created', {
         status: 'starting',
         created_at: Date.now(),