Make workspace IDs opaque, independent of the filesystem path (#1503)

* Make workspace IDs opaque, independent of the filesystem path

Workspace IDs were the resolved checkout/worktree path, so code could
treat an ID as a path: prefix matching, deriving directories from it,
falling back to a path when a lookup missed. IDs are now opaque -
compared only by exact equality and never used as a path. Anything
path-shaped resolves the workspace record first and reads its cwd.

New workspaces get a generated `wks_` ID; existing path-shaped IDs are
read from disk and never regenerated, so there is no migration and no
change to the wire or persisted schemas. Groundwork for running
multiple workspaces in a single directory.

* Keep attachment scope key stable and align refetch test

The attachment scope key keeps `workspace=` instead of `wsid=` so existing
persisted drafts are not orphaned; the rename was cosmetic. The SDK refetch
test no longer asserts a filter, matching refetch fetching one page and
selecting by id client-side.

* Fix live agent updates in directories without a registered workspace

The opaque-ID work removed buildProjectPlacementForCwd's directory
fallback, so an agent running in a folder with no registered workspace
(e.g. a fresh non-git dir) produced a null placement. forwardAgentUpdate
then threw "Workspace not found", the error was swallowed by its catch,
and no agent_update was emitted — live model/thinking switches and status
updates silently stopped. Caught by the live-preferences e2e suite.

The fallback builds a directory-scoped project placement keyed by the
path. That key is a project grouping key (non-git projects group by
path), not a workspace id, so it stays within the opaque-id rule.

* Always run server worktree archive, even without a resolved workspace

Archiving bailed out entirely when the workspace was not found in the
client store, so a race or stale state could make "archive" do nothing
server-side with only a console.warn. The server archive is keyed by
worktreePath, which is always available, so it now runs regardless; only
the optimistic client-side updates (keyed by workspace id) are gated on
the workspace being resolved.

* Expect a directory-scoped placement for unregistered agent dirs

This unit test asserted the no-placement behavior reverted in the live
agent-update fix, which had broken live model/thinking switching. Update
it to expect the directory-scoped placement now emitted for an agent in a
directory with no registered workspace.

* Fix opaque workspace routing in app E2E

* Preserve workspace IDs during partial bootstrap

* Fix archive flows for opaque workspace IDs

* Stop treating opaque workspace IDs as filesystem paths

Workspace IDs are opaque (wks_<hex>), but several call sites still passed
the id where a directory was expected, which broke those flows for opaque
IDs. The branch switcher sent the id as a cwd to branch/stash/checkout git
operations, and server archive/reconcile cleanup keyed git-watch and
subscription teardown by id, leaking that state.

Git and filesystem operations now take the workspace directory; the opaque
id is used only for identity and cache keys. Archive/reconcile cleanup
routes through a single teardownArchivedWorkspace helper that keeps the key
split explicit: runtime store by id, git watch and subscription by cwd.
Path-derived grouping keys are renamed to directory keys, and the helpers
are split into workspace-identity and workspace-directory so the id-vs-path
boundary is obvious.

packages/app/e2e/helpers/workspace-ui.ts

@@ -18,29 +18,8 @@ export async function waitForSidebarHydration(page: Page, timeout = 60_000): Pro
     .waitFor({ state: "visible", timeout });
 }
 
-export function workspaceLabelFromPath(value: string): string {
-  const normalized = value.replace(/\\/g, "/").replace(/\/+$/, "");
-  const parts = normalized.split("/").filter(Boolean);
-  return parts[parts.length - 1] ?? normalized;
-}
-
-function candidateWorkspaceIds(inputPath: string): string[] {
-  const trimmed = inputPath.replace(/\/+$/, "");
-  const candidates = new Set<string>([trimmed]);
-  if (trimmed.startsWith("/var/")) {
-    candidates.add(`/private${trimmed}`);
-  }
-  if (trimmed.startsWith("/private/var/")) {
-    candidates.add(trimmed.replace(/^\/private/, ""));
-  }
-  return Array.from(candidates);
-}
-
-function workspaceRowLocator(page: Page, serverId: string, workspacePath: string) {
-  const ids = candidateWorkspaceIds(workspacePath).map(
-    (id) => `[data-testid="sidebar-workspace-row-${serverId}:${id}"]`,
-  );
-  return page.locator(ids.join(",")).first();
+function workspaceRowLocator(page: Page, serverId: string, workspaceId: string) {
+  return page.getByTestId(`sidebar-workspace-row-${serverId}:${workspaceId}`).first();
 }
 
 export async function expectSidebarWorkspaceSelected(input: {
@@ -69,13 +48,13 @@ export async function expectSidebarWorkspaceSelected(input: {
 export async function switchWorkspaceViaSidebar(input: {
   page: Page;
   serverId: string;
-  targetWorkspacePath: string;
+  workspaceId: string;
 }): Promise<void> {
-  const row = workspaceRowLocator(input.page, input.serverId, input.targetWorkspacePath);
+  const row = workspaceRowLocator(input.page, input.serverId, input.workspaceId);
   await expect(row).toBeVisible({ timeout: 30_000 });
   await row.click();
 
-  const targetWorkspaceRoute = buildHostWorkspaceRoute(input.serverId, input.targetWorkspacePath);
+  const targetWorkspaceRoute = buildHostWorkspaceRoute(input.serverId, input.workspaceId);
   await expect(input.page).toHaveURL(new RegExp(escapeRegex(targetWorkspaceRoute)), {
     timeout: 30_000,
   });
@@ -89,11 +68,10 @@ export async function waitForWorkspaceInSidebar(
   page: Page,
   input: { serverId: string; workspaceId: string },
 ): Promise<void> {
-  const candidates = candidateWorkspaceIds(input.workspaceId);
-  const selector = candidates
-    .map((id) => `[data-testid="sidebar-workspace-row-${input.serverId}:${id}"]`)
-    .join(",");
-  await page.locator(selector).first().waitFor({ state: "visible", timeout: 60_000 });
+  await workspaceRowLocator(page, input.serverId, input.workspaceId).waitFor({
+    state: "visible",
+    timeout: 60_000,
+  });
 }
 
 export async function expectWorkspaceHeader(