fix(mcp): route workspace defaults without stale session pins

[mirnoorata]

Summary

• route unscoped workspace-root Codexa MCP requests through the Workspace Default focused repo even when other active session rows exist
• keep explicit focus and selected-session ambiguity checks fail-closed
• add regression coverage for session-start, doctor readiness, and MCP stdio routing behavior

Verification

• npm run check
• npm run security:check
• adversarial review pass: one session-start coverage gap fixed; final pass required before merge
• committed PR summary artifacts: docs/pr-summaries/codex-devops-codexa-20260701-codexa-srv-routing-fix/summary.md and summary.pdf

Notes

Local workspace MCP config was refreshed separately during validation and will be refreshed to the canonical merged checkout after merge.