p9: read workdir from core instead of cached session field

sess.workdir is only updated via the 9P write handler, so changes made
through the agent core (e.g. /cwd via ctl or prompt) were invisible to
readers. Use sess.core.WorkDir() to always reflect the live value.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/p9/server.go

@@ -552,7 +552,7 @@ func (s *Server) readFile(path string) string {
 	case "state":
 		return sess.state + "\n"
 	case "workdir":
-		return sess.workdir + "\n"
+		return sess.core.WorkDir() + "\n"
 	case "usage":
 		return sess.core.Usage() + "\n"
 	case "models":