feat(v0.3): M6 — new tab opens in the active tab's directory

- title-util.cwdFromOsc7: parse cwd from OSC 7 (file:// URL); 4 unit tests
- terminal-session: register OSC 7 handler → cwd getter; opts.cwd → sent in the
  attach frame on a fresh session
- protocol/types: ClientMessage attach.cwd (absolute path); validated
- session/manager/server: thread cwd → createSession spawn cwd (defaults homeDir)
- tabs: '+' (newTab) opens in the active tab's reported cwd, falls back to home
- Verified: server attach.cwd spawns there; cd /private/tmp → + → new tab pwd is
  /private/tmp. 212 tests green.

src/types.ts

@@ -39,9 +39,10 @@ export type EnvLike = Readonly<Record<string, string | undefined>>;
 
 /* ─────────────────────── protocol (§3.2) ─────────────────────── */
 
-/** client → server. approve/reject (H3) resolve a held PermissionRequest. */
+/** client → server. approve/reject (H3) resolve a held PermissionRequest.
+ *  attach.cwd (M6) = spawn a new session in this directory ("new tab here"). */
 export type ClientMessage =
-  | { type: 'attach'; sessionId: string | null }
+  | { type: 'attach'; sessionId: string | null; cwd?: string }
   | { type: 'input'; data: string }
   | { type: 'resize'; cols: number; rows: number }
   | { type: 'approve' }
@@ -167,7 +168,13 @@ export interface Session {
 /* ──────────────────────── manager (§3.5) ─────────────────────── */
 
 export interface SessionManager {
-  handleAttach(ws: WebSocketLike, sessionId: string | null, dims: Dims, now: number): Session;
+  handleAttach(
+    ws: WebSocketLike,
+    sessionId: string | null,
+    dims: Dims,
+    now: number,
+    cwd?: string,
+  ): Session;
   get(id: string): Session | undefined;
   /** Set a session's Claude status (from a hook) and push it to the attached ws (H2/H3). */
   handleHookEvent(