refactor(agents): move filesystem_state, path_resolver, sandbox to app/agents/shared (slice 3b)

Relocate three leaf filesystem-cluster modules to the shared kernel and flip
all 38 importers. No re-export shims needed (no frozen single-agent importer).
This also resolves the pre-existing shared->new_chat back-edge from
shared/receipt_command.py onto filesystem_state.

filesystem_backends is intentionally deferred to slice 5: it depends on
new_chat middleware (kb_postgres_backend, multi_root_local_folder_backend)
that have not yet moved, so relocating it now would create a shared->new_chat edge.

surfsense_backend/tests/unit/agents/new_chat/test_mention_resolver.py

@@ -22,7 +22,7 @@ from app.agents.new_chat.mention_resolver import (
     resolve_mentions,
     substitute_in_text,
 )
-from app.agents.new_chat.path_resolver import DOCUMENTS_ROOT, PathIndex
+from app.agents.shared.path_resolver import DOCUMENTS_ROOT, PathIndex
 from app.schemas.new_chat import MentionedDocumentInfo
 
 pytestmark = pytest.mark.unit

surfsense_backend/tests/unit/agents/new_chat/test_path_resolver.py

@@ -7,7 +7,7 @@ from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
-from app.agents.new_chat.path_resolver import (
+from app.agents.shared.path_resolver import (
     DOCUMENTS_ROOT,
     PathIndex,
     doc_to_virtual_path,