allow apps to specify cwd for sandbox setup. (#13484)

The electron app doesn't start up the app-server in a particular
workspace directory.
So sandbox setup happens in the app-installed directory instead of the
project workspace.

This allows the app do specify the workspace cwd so that the sandbox
setup actually sets up the ACLs instead of exiting fast and then having
the first shell command be slow.

codex-rs/app-server-protocol/schema/json/v2/WindowsSandboxSetupStartParams.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "cwd": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
     "mode": {
       "$ref": "#/definitions/WindowsSandboxSetupMode"
     }
@@ -19,4 +25,4 @@
   ],
   "title": "WindowsSandboxSetupStartParams",
   "type": "object"
-}
+}