ListSessions reads a.cmd and a.workDir without holding a.mu, while
SetWorkDir / SetSessionEnv / StartSession all touch those fields
under the lock. ProjectMemoryFile likewise reads a.workDir directly.
The sibling DeleteSession already uses the canonical
"capture under RLock" pattern; ListSessions and ProjectMemoryFile
were the inconsistent ones.
SetWorkDir mutates a.workDir under a.mu, so /workspace landing on
one goroutine while /list or a memory-file lookup runs on another
races on the string field. Strings carry a (ptr, len) pair, and a
torn read of a different-length string can produce a frankenstring
whose pointer doesn't match its length, leading to memory-safety
failures or empty/garbled paths.
Capture cmd and workDir inside the locked section in ListSessions;
capture workDir in ProjectMemoryFile. No public API or behaviour
change.
Regression: TestOpencodeAgent_WorkDirRaceFreeReaders spawns
concurrent SetWorkDir writers and ListSessions / ProjectMemoryFile
readers under -race. Without the production fix the test trips
"DATA RACE detected"; with the fix the detector stays quiet.
