source entrypoint should preserve caller cwd when delegating to compiled CLI

[chubes4]

Summary

The WP Codebox source-checkout entrypoint added in #1034 fixes missing dist/ in Lab snapshots, but it now runs the delegated compiled CLI with cwd set to the WP Codebox repo root. That changes relative path resolution for consumer plans and breaks agent-task recipes that intentionally pass workspace-relative component paths.

Evidence

Context: WPSG typed-artifact Lab loop from /Users/chubes/Developer/wp-site-generator@lab-typed-artifacts-loop-20260616 using:

HOMEBOY_WP_CODEBOX_BIN=.ci/wp-codebox/bin/wp-codebox-source.mjs

The source entrypoint correctly bootstrapped the missing build output:

WP Codebox CLI dist entrypoint is absent; bootstrapping the source checkout before running the CLI.
> wp-codebox-workspace@0.8.3 build

But the final recipe validation failed with missing workspace-relative dependencies:

Recipe validation failed with 9 issues.
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/agents-api
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/data-machine
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/data-machine-code
Directory does not exist: .../wp-codebox-agent-task-recipe-*/.ci/ai-provider-for-openai-codex-oauth-provider

The plan passes these as consumer workspace-relative paths:

.ci/agents-api
.ci/data-machine
.ci/data-machine-code
.ci/ai-provider-for-openai-codex-oauth-provider

They exist in the WPSG workspace. They do not exist relative to .ci/wp-codebox or the temp recipe directory.

Regression cause

bin/wp-codebox-source.mjs uses cwd: repoRoot in the shared run() helper for both bootstrap commands and the final delegated CLI execution.

Bootstrap commands need cwd: repoRoot, but the final compiled CLI must preserve the caller's original working directory so consumer-relative paths keep resolving against the consumer workspace.

Expected behavior

• npm ci / npm run build run from the WP Codebox source checkout root.
• The final node packages/cli/dist/index.js ... runs from the original caller cwd.
• Relative provider_plugin_paths, component contracts, mounts, and staged files continue to resolve relative to the consumer workspace.

Acceptance criteria

• Add coverage proving bin/wp-codebox-source.mjs bootstraps from the WP Codebox repo root but delegates the CLI from the original caller cwd.
• The existing source-checkout smoke still passes.
• A fixture invoking the source entrypoint from a separate consumer directory can resolve a relative path from that consumer cwd.
• No WPSG-specific behavior is added.

Related

• agent-task: source checkouts need a Lab-safe CLI entrypoint when dist is absent #1032
• Add source checkout CLI entrypoint #1034