[F118] coerce a lone-string where_to_look into a list

where_to_look is a list-typed handoff field like consequences/next_steps
but was the only one NOT in the _wrap_scalar_in_list field_validator. A
well-intentioned where_to_look='src/api/' 422'd at the route with no
remediation envelope, and the agent's retry loop tripped the do-server
circuit breaker — the exact failure mode the other list fields were
hardened against. Add it to the mode='before' validator so a lone string
is wrapped into a one-element list before type coercion.

tests/unit/api/schemas/v1/test_note_request_no_null.py

@@ -116,6 +116,18 @@ def test_note_request_coerces_string_next_steps_to_list() -> None:
     assert req.next_steps == ["wait for QA"]
 
 
+def test_note_request_coerces_string_where_to_look_to_list() -> None:
+    """F118: a single string for where_to_look is wrapped into a one-element
+    list. It is a list-typed handoff field like consequences/next_steps and
+    must tolerate a lone scalar — without this a well-intentioned
+    ``where_to_look="src/api/"`` 422'd at the route (no remediation envelope)
+    and the agent's retry loop tripped the do-server circuit breaker."""
+    req = NoteRequest.model_validate(
+        {"text": "x", "scope": "handoff", "where_to_look": "src/api/auth.py"}
+    )
+    assert req.where_to_look == ["src/api/auth.py"]
+
+
 def test_note_request_coerces_single_option_dict_to_list() -> None:
     """A single option dict (not wrapped in a list) is wrapped into a list."""
     req = NoteRequest.model_validate(