feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/fs/localfs.go

@@ -117,10 +117,13 @@ func (l *LocalFS) Mkdir(path string) error {
 
 // Remove removes path (file or directory recursively).
 func (l *LocalFS) Remove(path string) error {
-	abs, _, err := l.resolve(path)
+	abs, rel, err := l.resolve(path)
 	if err != nil {
 		return err
 	}
+	if rel == "." {
+		return util.New(util.CodeBadRequest, "cannot remove workspace root")
+	}
 	if err := os.RemoveAll(abs); err != nil {
 		return util.Wrap(util.CodeInternal, "failed to remove path", err)
 	}