feat(v0.3): M6 — new tab opens in the active tab's directory

- title-util.cwdFromOsc7: parse cwd from OSC 7 (file:// URL); 4 unit tests
- terminal-session: register OSC 7 handler → cwd getter; opts.cwd → sent in the
  attach frame on a fresh session
- protocol/types: ClientMessage attach.cwd (absolute path); validated
- session/manager/server: thread cwd → createSession spawn cwd (defaults homeDir)
- tabs: '+' (newTab) opens in the active tab's reported cwd, falls back to home
- Verified: server attach.cwd spawns there; cd /private/tmp → + → new tab pwd is
  /private/tmp. 212 tests green.

src/protocol.ts

@@ -133,8 +133,21 @@ function validateAttach(obj: Record<string, unknown>): ParseResult {
     return { ok: false, error: 'attach.sessionId field is required' }
   }
 
+  // Optional cwd (M6): must be an absolute path string if present.
+  const rawCwd = obj['cwd']
+  let cwd: string | undefined
+  if (rawCwd !== undefined) {
+    if (typeof rawCwd !== 'string' || !rawCwd.startsWith('/')) {
+      return { ok: false, error: 'attach.cwd must be an absolute path string' }
+    }
+    cwd = rawCwd
+  }
+
   if (sessionId === null) {
-    return { ok: true, message: { type: 'attach', sessionId: null } }
+    return {
+      ok: true,
+      message: cwd !== undefined ? { type: 'attach', sessionId: null, cwd } : { type: 'attach', sessionId: null },
+    }
   }
 
   if (typeof sessionId !== 'string') {
@@ -151,7 +164,10 @@ function validateAttach(obj: Record<string, unknown>): ParseResult {
     }
   }
 
-  return { ok: true, message: { type: 'attach', sessionId } }
+  return {
+    ok: true,
+    message: cwd !== undefined ? { type: 'attach', sessionId, cwd } : { type: 'attach', sessionId },
+  }
 }
 
 // ─── serialize ────────────────────────────────────────────────────────────────