Feat v0.8.1 workspace module (#68)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -2,6 +2,35 @@
 
 All notable changes to Armature are documented here.
 
+## v0.8.1 — Workspace Module
+
+New `workspace` sandbox module. Managed disk directories for extensions
+that need a real filesystem (git, compilers, media tools).
+
+**workspace module (permission: `workspace.manage`)**
+
+- `workspace.create(name)` — create a workspace directory (idempotent). Returns absolute path. Enforces quota if `WORKSPACE_QUOTA_MB` > 0.
+- `workspace.path(name)` — get the absolute path of an existing workspace. Returns None if not found.
+- `workspace.list()` — list workspace names for this extension.
+- `workspace.delete(name)` — recursively remove a workspace (idempotent).
+- `workspace.usage(name)` — disk usage in bytes (10-second timeout on directory walk).
+
+**Configuration**
+
+- `WORKSPACE_ROOT` — mount point for extension workspaces (default `/data/workspaces`).
+- `WORKSPACE_QUOTA_MB` — per-extension quota in MB (default `0` = unlimited).
+
+**Internal**
+
+- New file: `sandbox/workspace_module.go`.
+- New permission constant: `ExtPermWorkspaceManage`.
+- Config: `WorkspaceRoot`, `WorkspaceQuotaMB` fields.
+- Runner wiring: `SetWorkspaceRoot()` setter, `buildModulesWithLibCtx` creates workspace module when permission granted.
+- Startup: `main.go` creates workspace root directory if writable, graceful degradation if not.
+- All directories scoped to `{WORKSPACE_ROOT}/{packageID}/{name}/`.
+- Security: name regex (`^[a-z][a-z0-9_]{0,62}$`), `filepath.Clean` + prefix check, `filepath.EvalSymlinks` for symlink escape detection.
+- 16 new tests (create, path, list, delete, usage, name validation, quota enforcement).
+
 ## v0.8.0 — Files Module
 
 New `files` sandbox module. Bridges the existing ObjectStore (PVC/S3) into