fix(cosh): preserve user dirs in auto-memory workspace cleanup

[kongche-jbw]

Description

The auto-memory background extraction adds chatsDir and memoryDir to
the shared WorkspaceContext, then on cleanup calls
setDirectories(getInitialDirectories()). initialDirectories is a
snapshot frozen at constructor time and is never updated, so any
directory the user added at runtime via the /directory slash command
gets wiped when the background extraction finishes — and any subsequent
file access in those user directories silently fails the workspace
boundary check.

This change introduces WorkspaceContext.removeDirectory(path) and
makes the cleanup remove only the two directories auto-memory itself
added, leaving every other directory in the context untouched. The
extracted directories are tracked individually as they are added, which
also closes a partial-add leak: previously, if addDirectory(chatsDir)
succeeded but the subsequent mkdir/addDirectory(memoryDir) threw,
addedExtraDirs stayed false and the chatsDir entry leaked.

Related Issue

no-issue: bug fix surfaced during review of cba22cb

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• Multiple / Project-wide

Checklist

• I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For sec-core (Python): Ruff format and pytest pass
• For skill: Skill directory structure is valid and shell scripts pass syntax check
• For sight: cargo clippy -- -D warnings and cargo fmt --check pass
• For tokenless: cargo clippy -- -D warnings and cargo fmt --check pass
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

workspaceContext.test.ts gains six TDD-driven tests covering
removeDirectory: removal, leaving initial directories intact, no-op
on non-member, symlink resolution, listener notification, and throwing
on a non-existent path. Red-green confirmed: all six tests fail with
removeDirectory is not a function before the implementation, and pass
after. Full suite for the touched modules: 60/60 pass
(workspaceContext 40 + autoMemory/* 20).

Additional Notes

This fix is independent of #547 (the read_file/absolute_path arg-key
bug); both issues live in the auto-memory subsystem introduced in
cba22cb but touch disjoint files.