Resolve a client-supplied cwd into a canonical workspace binding.
cwd is untrusted and is validated here. workspace_config is not: every
caller passes server-resolved policy. A client claim is verified against
server policy in offload_api.workspace and never reaches this function.
