bug: extension trust gate evaluates process.cwd() but prompts/writes trust for workspaceDir

## What happened?

The extension manager's trust gate evaluates `isWorkspaceTrusted(this.settings)` — whose default `workspaceDir` parameter is `process.cwd()` — but the consent prompt and the persisted trust entry both use `this.workspaceDir`. Whenever an `ExtensionManager` is constructed with `workspaceDir !== process.cwd()`, the gate answers the **wrong question**: an untrusted workspace can pass because the CWD happens to be trusted (and vice versa), and trust gets recorded for a folder that was never evaluated.

## Affected code

`packages/cli/src/config/extension-manager.ts:219-235`:

```ts
if (!isWorkspaceTrusted(this.settings).isTrusted) { // evaluates cwd by default
if (
await this.requestConsent(
`The current workspace at "${this.workspaceDir}" is not trusted. ...`
)
) {
const trustedFolders = loadTrustedFolders();
await trustedFolders.setValue(
this.workspaceDir, // writes a different path
TrustLevel.TRUST_FOLDER,
);
```

Compare `trustedFolders.ts:44-51`: `isWorkspaceTrusted(settings, workspaceDir = process.cwd())`.

All current call sites happen to pass `process.cwd()`, so impact is latent — but the class API makes the mismatch reachable, and the message/recorded path already disagree with the evaluated path today if a caller passes a different dir.

## How can this be demonstrated?

Construct `new ExtensionManager(config, settings, cwdOverride)` where `cwdOverride` is untrusted while `process.cwd()` is trusted: extension install proceeds without consent and records trust for the override dir.

## What did you expect to happen?

Gate evaluation, user-facing message, and persisted entry must all reference the same directory: `isWorkspaceTrusted(this.settings, this.workspaceDir).isTrusted`.

## Suggested direction

One-line fix plus a regression test asserting the evaluated path equals the prompted/persisted path.

---

*Found by source audit on current `main` (commit `5411f113c`); platform-independent. No open issue/PR covering this was found (searched: isWorkspaceTrusted extensions).*

Start in packages/cli/src/config/extension-manager.ts around lines 219-235, then compare the workspaceDir handling with isWorkspaceTrusted in trustedFolders.ts:44-51. Add the regression test described in the issue and verify that the evaluated, prompted, and persisted directories match when the manager uses a non-CWD workspace.

Written by the indexing model from the issue text.