Promote AgentCompany-New to the repository root and retire the old app

The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.

tests/unit/workspace-path.test.ts

@@ -0,0 +1,31 @@
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { describe, expect, test } from "vitest";
+import { resolveWorkspacePath } from "../../src/main/services/files/workspace-path";
+
+describe("resolveWorkspacePath", () => {
+  const root = join(tmpdir(), "ac-workspace-root");
+
+  test("keeps a normal relative path inside the workspace", () => {
+    const { absolute, relativePosix } = resolveWorkspacePath(root, "plan/business-plan.md");
+    expect(relativePosix).toBe("plan/business-plan.md");
+    expect(absolute.startsWith(resolve(root))).toBe(true);
+  });
+
+  test("rejects paths that escape the workspace via traversal", () => {
+    expect(() => resolveWorkspacePath(root, "../../etc/passwd")).toThrow("escapes the workspace root");
+    expect(() => resolveWorkspacePath(root, "plan/../../../secret.key")).toThrow("escapes the workspace root");
+  });
+
+  test("normalises a leading slash and refuses real drive-absolute paths", () => {
+    // A leading slash is treated as workspace-relative, not a filesystem root.
+    expect(resolveWorkspacePath(root, "/notes.md").relativePosix).toBe("notes.md");
+    if (process.platform === "win32") {
+      expect(() => resolveWorkspacePath(root, "C:\\Windows\\System32")).toThrow("must be relative");
+    }
+  });
+
+  test("rejects an empty path", () => {
+    expect(() => resolveWorkspacePath(root, "   ")).toThrow("required");
+  });
+});