feat(wrapper): serve cwd probe + readable fallback — fix OpenChamber HTTP 500 under UID separation

[steffenmaechtel]

What

Headless opencode serve inherited the caller's working directory —
typically the developer's $HOME, unreadable for the opencode user by
design (UID separation). The server still booted, but every request that
loads config for that directory (/session, /config, /project)
answered HTTP 500: opencode treats EACCES on <dir>/opencode.jsonc
as a hard error instead of "no config file".

The wrapper now probes the serve cwd from the opencode user's context
via a new, sudoers-gated cwd-check.sh helper (stat-only, mirrors
socket-check.sh). When unreadable it warns on stderr and starts the
server from a readable fallback:

1. the projects.conf root containing the cwd,
2. else the first readable configured root,
3. else the opencode user's home.

An unavailable probe (older sudoers without the rule) changes nothing.

Docs recommend persisting OPENCHAMBER_OPENCODE_CWD=<projects root> for
a deterministic server directory; a troubleshooting entry documents
projectless chats as an upstream OpenChamber limitation (chat worktrees
hard-pinned to $HOME/.config/openchamber/chats + config root
force-chmodded to 0700 — not solvable kit-side).

Includes VERSION bump to 0.0.23.

Changed

• files/opencode-permissions-kit-lib/bin/cwd-check.sh (new) —
  readable/unreadable probe, always exits 0 (empty output = unknown)
• files/opencode-permissions-kit-lib/wrapper — probe, stderr warning,
  fallback selection before the exec
• files/sudoers.template — NOPASSWD rule for cwd-check.sh
  (update.sh re-renders sudoers, so existing installs pick it up)
• files/install.sh, files/update.sh — fetch/deploy/chmod lists
• Makefile lint scope + CI chmod lists (all three workflows)
• tests/test-wrapper-validation.sh — +16 tests (helper functional,
  fallback selection with stubbed probe, wiring/sudoers static)
• docs/how-to/openchamber.md, docs/concepts/wrapper.md

Validation

• sh tests/check-host.sh — host ready
• make test — all shell tests pass (incl. 71 wrapper-validation)
• make lint (ShellCheck incl. new helper), make check-version — OK
• make e2e — 238 PASS
• make e2e-rootless — 42 PASS
• Live-verified on the dev WSL2 host: OpenChamber started from $HOME,
  serve process fell back to /var/www/vhosts, /api/* answered 200