fleetd #480 follow-up: resolve a relative leadRollover.handoverPath against the calling lead's workspace

LeadRollover.open() now resolves handoverPath to an absolute path exactly once, against the
calling lead's fleet.leaders.<name>.cwd (falling back to the daemon's own user.dir when that
lead has none configured), matching the LeadLauncher#launch precedent. PendingRollover stores
only the resolved absolute path, so checkHandover's exists/empty/fresh checks, the path handed
back to the lead in the fleet_handover open response, and the default bootstrapText sentence
all see the same absolute location instead of a value resolved against whatever directory the
daemon process happened to start in.

FleetConfig.LeadRollover.bootstrapText is no longer defaulted in the compact constructor (it
would otherwise still bake in the raw, possibly-relative handoverPath); a new bootstrapTextFor
(resolvedHandoverPath) method builds the default sentence from the resolved path instead.

Fleetd.leadRollover(...) gains a required liveLeadTerminals parameter to build the terminal to
lead-name to Leader.cwd lookup, read live through the existing `leads` supplier and ConfigRef on
every call, never off a startup snapshot.

fleetd/fleetd.example.yaml

@@ -103,7 +103,12 @@ bind:
 #
 # handoverPath: REQUIRED when this block is present — where the handover file a fresh lead session
 #               reads must live. No default (an operator-specific path); a present block with no
-#               handoverPath refuses to start.
+#               handoverPath refuses to start. May be relative: it then resolves against the
+#               CALLING lead's own fleet.leaders.<name>.cwd (falling back to the daemon's own
+#               working directory when that lead has none configured) — never against whatever
+#               directory the daemon process happens to have been started in. An absolute path is
+#               used unchanged. Prefer an absolute path if the daemon and the lead's pane might not
+#               share a working directory (fleetd #480 follow-up).
 # requireOperatorConfirm: true    # default true — confirm() refuses unless the caller also passes
 #                                 # operatorConfirmed: true
 # maxDocAgeSeconds: 3600          # default 3600 — refuse a handover file older than this
@@ -114,8 +119,8 @@ bind:
 # clearSettleSeconds: 20          # default 20 — how long to wait for the pane to become injectable
 #                                 # again AFTER /clear before giving up (never sends bootstrapText
 #                                 # if this elapses). A separate, second wait from turnSettleSeconds.
-# bootstrapText: "..."            # default names handoverPath — sent to the lead once its pane
-#                                 # settles after /clear
+# bootstrapText: "..."            # default names the RESOLVED (absolute) handoverPath — sent to
+#                                 # the lead once its pane settles after /clear
 # leadRollover:
 #   handoverPath: /path/to/handover.md
 #   requireOperatorConfirm: true