feat(cli): start the command in the mapped current directory

The default --bind overlay mounted the current directory at
/root/<basename>, but the command still started in /root: the
library's working-directory fallback only considers read-write
binds.  Pass the mapped target as the explicit working_dir so
relative paths keep meaning what they meant on the host.

Bind sources are canonicalized when the targets are built
instead of at mount time.  This fixes --bind . and other
basename-less relative paths, which cli_mount_target rejected,
and lets the --bind/--bind-rw dedup match relative and absolute
spellings of the same directory.

Cargo.lock

@@ -331,6 +331,7 @@ dependencies = [
  "ecr",
  "indicatif",
  "log",
+ "tempfile",
 ]
 
 [[package]]