对齐 run_command 与 write_file 的默认路径行为。

将 run_command 在未传 cwd 时改为默认 data/workspace，并将 write_file 调整为相对路径写入 data/workspace、绝对路径直写（经路径守卫校验），同步更新测试与文档。

Made-with: Cursor

docs/LOCAL_PUBLIC_TOOLS.md

@@ -39,3 +39,8 @@ This project exposes local atomic capabilities as shared `public` tools for all
 
 - Adapter path: `runtime/tools/local_sdk/adapter.py`.
 - Uses a self-implemented local backend (cross-platform) with a stable tool contract.
+
+## Path behavior defaults
+
+- `run_command`: when `cwd` is omitted, it runs in `data/workspace`.
+- `write_file`: absolute path is used directly; relative path is written under `data/workspace`.