Auto-heal witness beads redirects

[punitrathore]

Summary

• include witness in gt prime's automatic .beads redirect healing
• provision the shared beads redirect when starting a witness session
• add a regression test covering witness redirect creation

Verification

• go test ./internal/cmd -run 'TestEnsureBeadsRedirect_WitnessCreatesRedirect|TestCompactResumeReminder_PolecatGetsGtDone|TestCompactResumeReminder_NonPolecatNoGtDone'
• go test ./internal/witness

Context

This fixes a live ManaSutra witness incident where patrol commands run from /witness fell back to an incomplete rig-root .beads directory and failed before patrol could proceed.