fix(telegram): resolve send_attachment paths in the user's workspace

`send_attachment` handed its `file_path` argument straight to
`InputFile::file`, which resolves against the **server process's** working
directory. Every path the model can actually have — relative to the user's
home, or absolute inside their container — failed the `path.exists()` check,
and the one class that didn't (a name that happens to exist next to the
binary) would have sent the wrong file.

The routing already exists for the fs-tools, so expose it rather than repeat
it: `UserFilesApi` (core-api) reads a path in the agent's own vocabulary and
is obtained from `UserChannelHandle::files()`, so it is scoped to one user by
construction. skald-core implements it over `resolve_view_target` — host
mount read directly, container-only path through `docker exec` — holding the
`SharedFs` cell rather than a snapshot, so a remount lands without a login.

The size cap is checked before the read (a new `exec_fs::size` for the
container branch): the point of a cap is to keep an oversized file out of RAM,
so checking it afterwards would protect nothing. A photo above `sendPhoto`'s
narrower 10 MB ceiling goes out as a document instead of as an API error.

crates/core-api/src/user_channel.rs

@@ -23,6 +23,7 @@ use crate::approval::ApprovalApi;
 use crate::chat_hub::ChatHubApi;
 use crate::events::GlobalEvent;
 use crate::inbox::InboxApi;
+use crate::user_files::UserFilesApi;
 
 /// Resolves an unlocked user's channel handle.
 ///
@@ -84,6 +85,13 @@ pub trait UserChannelHandle: Send + Sync {
     /// `approval()`/clarification/elicitation separately.
     fn inbox(&self) -> Arc<dyn InboxApi>;
 
+    /// The user's workspace files — reading a path in the agent's own vocabulary
+    /// (`~/…`, `shared/{X}/…`, `/tmp/…`), routed to the host mount or to the
+    /// container exactly as the fs-tools route it. A channel adapter that sends a
+    /// file back to the user goes through this rather than the host filesystem,
+    /// whose cwd is the server's and not the user's.
+    fn files(&self) -> Arc<dyn UserFilesApi>;
+
     /// Subscribe to the user's server→client event stream.
     /// Events are scoped to this user; no cross-user leakage.
     fn subscribe(&self) -> broadcast::Receiver<GlobalEvent>;