test(05-03): add failing shared-volume attachment contract tests

- cover room-safe Matrix inbox paths under /agents workspaces
- assert /workspace and /agents file paths normalize to relative workspace paths

tests/adapter/matrix/test_files.py

@@ -48,3 +48,20 @@ async def test_download_matrix_attachment_persists_file_and_returns_workspace_pa
     assert saved.workspace_path is not None
     assert saved.workspace_path.endswith("20260420-153000-report.pdf")
     assert (tmp_path / saved.workspace_path).read_bytes() == b"%PDF-1.7"
+
+
+def test_build_workspace_attachment_path_keeps_room_safe_agents_relative_contract(tmp_path: Path):
+    rel_path, abs_path = build_workspace_attachment_path(
+        workspace_root=tmp_path / "agents" / "7",
+        matrix_user_id="@alice+bob:example.org",
+        room_id="!room/ops:example.org",
+        filename="quarterly status (final).pdf",
+        timestamp="20260420-153000",
+    )
+
+    assert rel_path == (
+        "surfaces/matrix/alice_bob_example.org/room_ops_example.org/inbox/"
+        "20260420-153000-quarterly_status_final_.pdf"
+    )
+    assert not Path(rel_path).is_absolute()
+    assert abs_path == tmp_path / "agents" / "7" / rel_path