#9531 fix(files): resolve v2 file paths only on the v2 surface, through the canonical resolver

Summary

Follow-up to #9504, rebuilt on #9527 (authorize the workspace before an unresolved path answers):

• resolveActiveWorkspaceFileContext is shared by ~26 callers, so turning files/… strings into ids there widened every internal surface: an internal caller passing a file name that starts with files/ as an id resolved it as a path. It now takes an explicit acceptVfsPath flag, which only the three v2 routes (describe, rename, delete) set. Every other caller keeps id-only semantics.
• Paths resolve through the existing resolveFileReference (folder-first, owner-scoped, at most two rows) instead of the bespoke getWorkspaceFileByVfsPath, which is deleted. One resolver now serves workspace and project files. Its ambiguity conflict maps onto #9527's UnresolvedWorkspaceFileVfsPathError, so a member still gets "pass the file id instead" and a non-member the same refusal as for any other path.
• A bare files/ names nothing and is no longer treated as a path; the contract rejects it like any other malformed reference.
• The three use-case inputs share one WorkspaceFileTargetInput; restore's lifecycle resolver takes only the fields it reads.
• Contract text, OpenAPI, CLI client and CLI docs regenerated.

Type of Change

• Bug fix

Testing

• file-path-references.integration.ts against disposable Postgres via bun run test:integration: 13/13. New cases: a caller that didn't opt in resolves no path; a bare files/; a non-member's personal key on a workspace with personal keys off gets the same answer for an ambiguous, a missing and an existing path
• Red proofs: without the opt-in check, "did not opt in" fails; letting the resolver's conflict out pre-authorization fails the member, non-member, delegation and personal-key cases
• v2 file route tests and lib/workspace-files/application: 245 pass
• check:openapi, check:cli-api, check:api-validation:strict, check:comment-hygiene, check:test-patterns; rest in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)