v0.8.4: Documentation refresh + surface sizing fix

Docs pass covering v0.7.5–v0.8.3 module additions:
- STARLARK-REFERENCE: workspace module, permissions module, settings.has_capability()
- EXTENSION-GUIDE: capabilities manifest, vector(N) column, user_permissions,
  gate_permission, updated permissions list
- Tutorial reviewed for v0.7+ accuracy (no changes needed)

Surface sizing fix: .surface-inner converted to flex column layout so
the shell topbar and surface container share vertical space correctly.
All surface containers changed from height:100% to flex:1;min-height:0.
Eliminates 44px scroll cutoff on docs, admin, settings, and all
extension surfaces.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/STARLARK-REFERENCE.md

@@ -37,6 +37,17 @@ val = settings.get("theme", "light")
 The cascade respects the `user_overridable` flag from the package manifest.
 See [Permissions & Groups](PERMISSIONS-AND-GROUPS) for details.
 
+```python
+# Check if a runtime capability is available
+if settings.has_capability("pgvector"):
+    # Use native vector search
+    ...
+```
+
+`has_capability(name)` returns `True` if the named environment capability
+is detected by the kernel. Detected capabilities: `pgvector`, `workspace`,
+`object_storage`, `s3`, `postgres`.
+
 ### lib
 
 Load exported functions from library packages.
@@ -53,6 +64,20 @@ Requirements:
 - Results are cached per execution (calling `require` twice returns the
   same object).
 
+### permissions
+
+Check whether a user has a specific permission.
+
+```python
+if permissions.check(user_id, "image-gen.use"):
+    # User is authorized
+    ...
+```
+
+Returns `True` if the user has the permission, `False` otherwise (including
+when the user is not found). Resolves the user's groups and merges granted
+permissions — works for both kernel and extension-declared permissions.
+
 ## Permission-gated modules
 
 These modules are only available if the package has the corresponding
@@ -344,6 +369,41 @@ files.delete_prefix("temp/")
 
 ---
 
+### workspace
+
+**Permission:** `workspace.manage`
+
+Managed disk directories for extensions that need a real filesystem
+(git clones, compilers, media tools). Each workspace is scoped to
+`{WORKSPACE_ROOT}/{packageID}/{name}/`.
+
+```python
+# Create a workspace (idempotent)
+path = workspace.create("my-repo")
+# Returns the absolute path to the directory
+
+# Get the path (None if workspace doesn't exist)
+path = workspace.path("my-repo")
+
+# List all workspaces owned by this extension
+names = workspace.list()  # ["my-repo", "cache"]
+
+# Delete a workspace and all its contents
+workspace.delete("my-repo")
+
+# Get disk usage in bytes (10-second timeout)
+size = workspace.usage("my-repo")  # 1048576
+```
+
+**Constraints:**
+- Names must match `^[a-z][a-z0-9_]{0,62}$` (lowercase, no spaces or separators).
+- Path traversal and symlink escape are blocked.
+- Quota enforcement via `WORKSPACE_QUOTA_MB` env var (0 = unlimited).
+- Module not available if `WORKSPACE_ROOT` is unset or not writable.
+  Use `settings.has_capability("workspace")` to check availability.
+
+---
+
 ## Example: automated stage hook
 
 A simple hook that reads a setting, queries data, and advances: