Review: Fix is correct, but surfaces a pre-existing bug in init_session() error handling

The core fix (cd {quoted_init_cwd} || exit 126) is correct and matches the diagnosis.

However, I noticed that the init_session() try/except block unconditionally sets self._snapshot_ready = True after a successful _wait_for_process() call, regardless of the subprocess exit code:

try:
    proc = self._run_bash(bootstrap, login=True, timeout=self._snapshot_timeout)
    result = self._wait_for_process(proc, timeout=self._snapshot_timeout)
    self._snapshot_ready = True   # ← set unconditionally; exit code 126 is ignored
    self._update_cwd(result)
    ...
except Exception as exc:
    self._snapshot_ready = False  # ← only Exception triggers this

When cd || exit 126 fails, _wait_for_process() returns normally with returncode=126 (no exception is raised), so _snapshot_ready ends up True even though the cd failed.

This is a pre-existing bug independent of this PR. Before this PR, the snapshot was always created successfully but captured the wrong CWD. After this PR, in the normal case it now captures the correct CWD—but when the configured cwd doesn't exist, the behavior is still broken (snapshot marked ready with the wrong path).

Suggestion: Consider also checking result.get("returncode") != 0 in init_session() and setting _snapshot_ready = False accordingly. The fallback to bash -l per command is the intended safe behavior when the snapshot can't be established at the configured path.

The PR fix itself is correct and ready to merge. This is a separate, pre-existing issue worth addressing either as a follow-up or as part of this PR if the maintainer prefers.

（Generated by AI Agent）