fix(review): Windows cross-drive annotation paths escape the workspace guard

[BenNewman100]

Problem

normalizeAgentPath in packages/shared/review-workspace.ts guards its path.relative() results with startsWith("..") / startsWith("/") checks. On Windows, path.relative() cannot relativize across drives and returns the target's absolute path instead. After backslash normalization that result looks like L:/... — it slips past both checks and gets prefixed with the repo label, producing annotation paths like api/L:/checkout/src/file.ts.

Practical symptom: the existing test "normalizes agent annotation paths to workspace-prefixed paths" fails on a pristine checkout for any Windows contributor whose repo lives on a different drive than %TEMP% — the workspace fixtures are created under tmpdir(), and the relative input "src/file.ts" resolves against the checkout's cwd, so relative() spans two drives.

Fix

Extract the guard into isRepoRelative() and additionally reject drive-letter-prefixed results (/^[A-Za-z]:/). Applied at all three call sites in normalizeAgentPath. Pure string logic, so behavior is identical across platforms.

Testing

• On a Windows box with the checkout and %TEMP% on different drives: bun test packages/server/review-workspace.test.ts — the annotation-path test now passes (it failed before this change); the file's remaining failures on that box are pre-existing environment issues, identical on main
• Added a platform-independent unit test for isRepoRelative covering the cross-drive shape
• bun run typecheck — all projects pass