fix: drop /root/repo fallback in vm exec for unbound VMs

vm exec defaulted execGuestPath to /root/repo whenever the VM had no
recorded workspace, so running it against a plain VM (one that never
had vm workspace prepare / vm run ./repo) blew up with
'cd: /root/repo: No such file or directory' — surfaced via the login
shell's mise activate hook because bash -lc sources profile.d before
the explicit cd. Now auto-cd only fires when --guest-path is passed
or the VM actually has a workspace recorded; otherwise the command
runs from root's home. Mise wrapping unchanged — without a .mise.toml
it's a no-op.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -10,6 +10,26 @@ changed between versions.
 
 ## [Unreleased]
 
+### Fixed
+
+- `vm exec` no longer falls back to `cd /root/repo` on VMs that have
+  no recorded workspace. Previously, running `vm exec` against a plain
+  VM (one that never had `vm workspace prepare` / `vm run ./repo`)
+  blew up with `cd: /root/repo: No such file or directory` — surfaced
+  via the login shell's mise activate hook because `bash -lc` sources
+  profile.d before the explicit cd. Now the auto-cd only fires when
+  the user passes `--guest-path` or the VM actually has a workspace
+  recorded; otherwise the command runs from root's home. Mise wrapping
+  is unchanged — without a `.mise.toml` it's a no-op.
+
+### Changed
+
+- `vm exec --guest-path` default in `--help` now reads "from last
+  workspace prepare; otherwise root's home" (was "or /root/repo").
+  Anyone who relied on the implicit `/root/repo` default for a VM that
+  has a repo there but no workspace record must now pass
+  `--guest-path /root/repo` explicitly.
+
 ## [v0.1.8] - 2026-05-01
 
 ### Fixed