feat: index extra source roots beside the workspace, for the code you write against

The workspace index cannot answer questions about an installed framework or
SDK, and in plugin development that is where most of the reading goes: 64 of
80 tool calls in one real session went to the harness checkout under
/usr/local/lib/node_modules to look up the API being implemented.

A root is entered whatever it is called, and its dependencies are not: a
path ending in node_modules/... is the normal way to name a package tree,
while a node_modules below the root is somebody else's code. A result
carries the label that says which tree it came from and an absolute
sourcePath, the only form a follow-up read can resolve.

The tool description now also claims the move this replaces - searching
before reading files to find out what a module contains.

test/helpers.js

@@ -102,8 +102,14 @@ export function makeContext(options = {}) {
 }
 
 /** An `exec` argument for one tool call. */
-export function makeExec(cwd, signal) {
-  return { signal: signal ?? new AbortController().signal, agent: { session: { header: { cwd } } } }
+export function makeExec(cwd, signal, sessionId = 'session-under-test') {
+  // `agent.id` is the SESSION id — the jobs registry resolves a background job's
+  // owner through `agents.get(id)` and refuses anything that is not that string.
+  // A fixture without it cannot catch a call that passes the whole handle.
+  return {
+    signal: signal ?? new AbortController().signal,
+    agent: { id: sessionId, session: { header: { cwd } } },
+  }
 }
 
 /** Write a map of relative path to content into a fresh temporary directory. */