fix(env): harden the PATH preset per review (T-511)

Three holes from the T-511 adversarial review pass:

- An entry containing the PATH separator smuggled extra tokens into
  the joined PATH — a stray trailing ':' yields an EMPTY token, which
  POSIX shells resolve as CWD (the dot-in-PATH hazard). The CLI verb
  and the settings control now reject such entries, and applyPathPreset
  skips malformed stored values that predate the check.
- The gitdir pointer a worktree resolution follows is repo-controlled
  text; the resolved main root is now validated (must hold a real
  .git directory) before its preset key is trusted, so a crafted
  pointer can't alias an arbitrary path's preset.
- A pane spawned with a cwd below the workspace root hashed the
  subdirectory and silently missed the workspace preset; the lookup
  now keys any in-workspace cwd to the workspace root
  (presetLookupRoot).

Also: the Add button pairs buttonBackground with its own
buttonHoverBackground token instead of borrowing the list-item hover
token, and the hosted-Claude leg gains an end-to-end orchestrator test
(preset lookup → spawn env).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/builtin/tools_settings/src/path_preset_control.dart

@@ -77,6 +77,10 @@ class _PathPresetControlState extends State<PathPresetControl> {
       d = d == '~' ? home : '$home${d.substring(1)}';
     }
     if (d.isEmpty || !(d.startsWith('/') || RegExp(r'^[A-Za-z]:[/\\]').hasMatch(d))) return null;
+    // One dir per entry — an embedded PATH separator would smuggle extra
+    // (possibly empty → CWD) tokens into the joined PATH.
+    final body = RegExp(r'^[A-Za-z]:').hasMatch(d) ? d.substring(2) : d;
+    if (body.contains(':') || body.contains(';')) return null;
     while (d.length > 1 && d.endsWith('/')) {
       d = d.substring(0, d.length - 1);
     }
@@ -293,7 +297,7 @@ class _PathPresetControlState extends State<PathPresetControl> {
             onTap: () => _add(services, cwd),
             builder: (ctx, hovered, _) => Container(
               padding: const EdgeInsets.symmetric(horizontal: 12, vertical: 5),
-              decoration: BoxDecoration(color: hovered ? tokens.listItemHoverBackground : tokens.buttonBackground, borderRadius: BorderRadius.circular(4)),
+              decoration: BoxDecoration(color: hovered ? tokens.buttonHoverBackground : tokens.buttonBackground, borderRadius: BorderRadius.circular(4)),
               child: ClideText(addLabel, color: tokens.buttonForeground, fontSize: clideFontCaption),
             ),
           ),