Feat v0.8.1 workspace module

Managed disk directories for extensions needing real filesystem access
(git, compilers, media tools). Five builtins: create, path, list,
delete, usage. Extension-scoped to {WORKSPACE_ROOT}/{packageID}/{name}/.

- New sandbox/workspace_module.go with path traversal + symlink protection
- Permission: workspace.manage; config: WORKSPACE_ROOT, WORKSPACE_QUOTA_MB
- Runner wiring with graceful degradation (module absent if root unwritable)
- 16 new tests, all passing with -race

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -1,6 +1,6 @@
 # Armature — Roadmap
 
-## Current: v0.8.0 — Files Module
+## Current: v0.8.1 — Workspace Module
 
 Self-hosted extensible platform kernel. Auth, identity, packages, Starlark
 sandbox, storage, realtime, and ops are kernel primitives. Everything else
@@ -397,14 +397,18 @@ key namespacing (`ext/{packageID}/`). Permissions: `files.read`,
 New: `sandbox/files_module.go`. Modified: runner wiring, permission
 constants. `ObjectStore` interface gained `List()` method. 16 new tests.
 
-**v0.8.1 — `workspace` Module**
+**v0.8.1 — `workspace` Module** ✅
 
 Managed disk directories for tools that need a real filesystem (git,
-compilers, media tools). `workspace.create(name)` → scoped path.
-Permission: `workspace.manage`. Quota enforcement via `WORKSPACE_QUOTA_MB`.
+compilers, media tools). Extension-scoped path namespacing
+(`{WORKSPACE_ROOT}/{packageID}/{name}/`). Five builtins: `create`,
+`path`, `list`, `delete`, `usage`. Permission: `workspace.manage`.
+Quota enforcement via `WORKSPACE_QUOTA_MB`. Path traversal and symlink
+escape protection.
 
 New: `sandbox/workspace_module.go`. Modified: runner wiring, permission
-constants.
+constants, config (`WORKSPACE_ROOT`, `WORKSPACE_QUOTA_MB`), main.go
+startup. 16 new tests.
 
 **v0.8.2 — Capability Negotiation**