backlog: file #1062, check reads env values from cwd after validating them under --project-root

[wshallwshall]

Files BACKLOG #1062. Docs-only, one file, +37. No fix, no code change.

THE DEFECT. messagefoundry check accepts an explicit --project-root, validates that
<root>/<env_dir>/<env>.toml EXISTS under it, and then DROPS the root. _check_build
re-derives the value anchor from Path.cwd(). So build-check verifies the file under the
supplied root and READS THE VALUES from wherever the shell happens to be standing.

CHAIN, read end to end rather than inferred from the symptom:

• the root is dropped at main.py:853
• run_checks takes no root parameter
• checks.py:1304 re-derives from Path.cwd()
• resolve_values_base_dir returns cwd when base_dir is empty -- which is the SHIPPED DEFAULT

serve does it correctly in the same file (:1086), writing the project root into
environments.base_dir before load_settings, with a comment saying why. The comment
directly above the defect claims parity with serve, and the missing step is exactly that
parity.

WHY IT IS FILED SEPARATELY. This is the fourth instance of one premise: THAT WHERE A
COMMAND RUNS IS WHERE THE CALLER IS. The other three are #1057 (occupancy places sessions
by cwd, so it cannot see a session writing by absolute path from elsewhere -- the script
puts that at 29% of writes on this repo), #1059 (the worktree gate resolves paths against
the session cwd, so a shell variable defeats it), and #1060 (alloc.ps1 takes the owning
worktree from git rev-parse --show-toplevel). All four fail SILENTLY and in the
benign-looking direction.

This one is the most significant of the four because it is on the ENGINE surface rather
than the coordination scripts, which is where nobody was looking. No theme item was filed
for the pattern -- "four mechanisms share a premise" has no fix and no closing condition,
and the premise is already recorded as prose in docs/WORKTREES.md (#1060) where it
outlives any single item.

Claims to violate ADR 0050 AC-6 with an untested acceptance criterion.

VERIFICATION. Based on 0a994e0, merge-tree CLEAN against current main. Headings
139 -> 140, exactly one added and nothing lost. Number allocated atomically from the
committing worktree.

[wshallwshall]

Superseded by a fresh cut off current main. #1063 (PR #237) merged first, leaving this branch's base squash-merged away, so rebasing it would hit the pre-squash-base trap and a force-push would rewrite a branch whose ledger entitlement belongs to another worktree. The item is re-filed unchanged from the allocating worktree; see the replacement PR. No content is lost -- f9bea40 remains readable in the shared object store.