source entrypoint should preserve caller cwd when delegating to compiled CLI

## Summary

The WP Codebox source-checkout entrypoint added in #1034 fixes missing `dist/` in Lab snapshots, but it now runs the delegated compiled CLI with `cwd` set to the WP Codebox repo root. That changes relative path resolution for consumer plans and breaks agent-task recipes that intentionally pass workspace-relative component paths.

## Evidence

Context: WPSG typed-artifact Lab loop from `/Users/chubes/Developer/wp-site-generator@lab-typed-artifacts-loop-20260616` using:

```text
HOMEBOY_WP_CODEBOX_BIN=.ci/wp-codebox/bin/wp-codebox-source.mjs
```

The source entrypoint correctly bootstrapped the missing build output:

```text
WP Codebox CLI dist entrypoint is absent; bootstrapping the source checkout before running the CLI.
> wp-codebox-workspace@0.8.3 build
```

But the final recipe validation failed with missing workspace-relative dependencies:

```text
Recipe validation failed with 9 issues.
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/agents-api
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/data-machine
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/data-machine-code
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/ai-provider-for-openai-codex-oauth-provider
```

The plan passes these as consumer workspace-relative paths:

```text
.ci/agents-api
.ci/data-machine
.ci/data-machine-code
.ci/ai-provider-for-openai-codex-oauth-provider
```

They exist in the WPSG workspace. They do not exist relative to `.ci/wp-codebox` or the temp recipe directory.

## Regression cause

`bin/wp-codebox-source.mjs` uses `cwd: repoRoot` in the shared `run()` helper for both bootstrap commands and the final delegated CLI execution.

Bootstrap commands need `cwd: repoRoot`, but the final compiled CLI must preserve the caller's original working directory so consumer-relative paths keep resolving against the consumer workspace.

## Expected behavior

- `npm ci` / `npm run build` run from the WP Codebox source checkout root.
- The final `node packages/cli/dist/index.js ...` runs from the original caller cwd.
- Relative `provider_plugin_paths`, component contracts, mounts, and staged files continue to resolve relative to the consumer workspace.

## Acceptance criteria

- Add coverage proving `bin/wp-codebox-source.mjs` bootstraps from the WP Codebox repo root but delegates the CLI from the original caller cwd.
- The existing source-checkout smoke still passes.
- A fixture invoking the source entrypoint from a separate consumer directory can resolve a relative path from that consumer cwd.
- No WPSG-specific behavior is added.

## Related

- #1032
- #1034

Start with bin/wp-codebox-source.mjs and its shared run() helper, then inspect the existing source-checkout smoke coverage. Add coverage showing bootstrap commands run from the WP Codebox repo root while the delegated compiled CLI preserves the caller cwd; verify a separate consumer-directory fixture resolves a relative path and the smoke test still passes.

Written by the indexing model from the issue text.