fix: scope V2 task recovery to plugin location

[danyel117]

Closes #57

Summary

• reuse the existing V2 session-ownership check before loading restart-recovery transcripts
• skip goals owned by other directories/workspaces while preserving legacy behavior when the host does not expose a location
• add regression coverage proving only the local goal transcript is read
• rebuild the tracked server bundle

Validation

• bun run lint
• bun run typecheck
• bun test — 296 passed, 0 failed
• bun run build
• bun run pack:dry-run

Audit

Claude Code CLI with Opus, audit 1: no high or medium findings. Four low observations were noted (diagnostic logging on ownership lookup failure, one harmless post-dispose request window, serial ownership lookups, and two optional test gaps); none block correctness or safety. No correction cycle was required.

AI assistance

Implementation: Codex (GPT-5). Review: Claude Code CLI with Opus.