CB-114: resolveCwd never returns null (honor the 'daemon cwd, never $HOME' contract)

Final review-sweep finding: firstNonBlank(requestedCwd, cfg.cwd(), callerCwd,
user.dir) returns null if all are blank (pathological env with user.dir unset),
after which AgentControl drops the cwd and herdr defaults the pane to $HOME —
violating CB-112's documented contract. Append "." (the daemon's own cwd) as a
guaranteed non-blank last resort. Near-impossible trigger; makes the code honor its
own javadoc. 105 tests green.

bridged/src/main/java/dev/ltms/bridged/worker/WorkerService.java

@@ -134,9 +134,14 @@ public final class WorkerService {
                 : spawnAsPane(cfg, workerEnv, argv, cwd);
     }
 
-    /** CB-112 cwd resolution: spawn arg → profile config → the primary's cwd → the daemon's cwd. */
+    /**
+     * CB-112 cwd resolution: spawn arg → profile config → the primary's cwd → the daemon's cwd.
+     * Never returns {@code null}/blank: {@code "."} (the daemon's own working directory) is the
+     * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
+     * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
+     */
     private static String resolveCwd(String requestedCwd, BridgedConfig.Worker cfg, String callerCwd) {
-        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"));
+        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
     }
 
     private static String firstNonBlank(String... values) {