fix(attempt): pass resolved workspace path into recordTokenUsage

runEmbeddedAttempt calls process.chdir(effectiveWorkspace) early in the
run, then later invokes recordTokenUsage with the raw params.workspaceDir
string.  If workspaceDir is a relative path (e.g. ./ws) recordTokenUsage
resolves it from the already-changed cwd, producing a nested path
(`./ws/ws/memory/token-usage.json`) or an outright failure.

Fix: pass effectiveWorkspace (the fully-resolved, sandbox-aware absolute
path that was used for every other workspace operation in the run) into
recordTokenUsage so usage logs always land in the correct directory.

src/agents/pi-embedded-runner/run/attempt.ts

@@ -2822,7 +2822,7 @@ export async function runEmbeddedAttempt(
       }
 
       recordTokenUsage({
-        workspaceDir: params.workspaceDir,
+        workspaceDir: effectiveWorkspace,
         runId: params.runId,
         sessionId: params.sessionId,
         sessionKey: params.sessionKey,