fix(runtime): relocate dependency artifact paths in cloud worker handoffs

Summary

On release/v0.1.0, a relocated Modal worker can run a dependency-free cloud task, but the first cloud task with an artifact dependency fails during prepare:* before agent inference:

prepare:<attempt> failed at step assert-task-inputs: artifact handoff directory is unsafe: .ultrafuzz/runs/cloud-worker/artifacts/planner

The selected-task handoff correctly carries project-relative paths. hydrateSelectedTaskHandoff calls relocatedHandoffPath to validate every dependency and reference path, but then stores the original relative arrays. assertTaskInputs later requires each dependency directory to equal its canonical realpath, so every dependent cloud node is rejected.

Minimal generic reproduction

Use the existing synthetic cloud-worker fixture (no external target):

1. Compile a two-stage cloud topology whose downstream node consumes the upstream artifact directory.
2. Relocate the generated workflow/project with the existing cloud-worker harness.
3. Render the downstream selected-task handoff and capture its hydrated task spec.
4. Assert each dependencyArtifactDirs entry is absolute and rooted under the relocated worker.

Observed on base 9b0bc8cab2e681bbffeee385c1f80f85a47087d3:

not ok - a relocated cloud worker resolves dependency handoff directories under its own root
dependency must be absolute: .ultrafuzz/runs/cloud-worker/artifacts/planner
false !== true

The focused fixture fails before any provider/model request.

Expected behavior

Hydration should retain canonical relocated values for dependency and reference artifact directories (and the relocated catalog path) after validating the handoff. The prepare-time safety and verification gates should then operate on absolute children of the worker root.

Duplicate search

No issue or PR matched the exact error or the assert-task-inputs/relative dependency-handoff failure. Main-only PR #621 includes a much broader refactor that resolves dependency paths against process.cwd(), but the concrete release failure is not tracked and release/v0.1.0 still reproduces it.

Start with hydrateSelectedTaskHandoff, relocatedHandoffPath, and assertTaskInputs, then run the existing synthetic cloud-worker fixture on release/v0.1.0. Reproduce the two-stage relocated workflow and inspect the hydrated task spec. Done means dependencyArtifactDirs and the catalog path retain absolute canonical values rooted under the relocated worker, with the focused safety checks passing.