Make workspace IDs opaque, independent of the filesystem path (#1503)

* Make workspace IDs opaque, independent of the filesystem path

Workspace IDs were the resolved checkout/worktree path, so code could
treat an ID as a path: prefix matching, deriving directories from it,
falling back to a path when a lookup missed. IDs are now opaque -
compared only by exact equality and never used as a path. Anything
path-shaped resolves the workspace record first and reads its cwd.

New workspaces get a generated `wks_` ID; existing path-shaped IDs are
read from disk and never regenerated, so there is no migration and no
change to the wire or persisted schemas. Groundwork for running
multiple workspaces in a single directory.

* Keep attachment scope key stable and align refetch test

The attachment scope key keeps `workspace=` instead of `wsid=` so existing
persisted drafts are not orphaned; the rename was cosmetic. The SDK refetch
test no longer asserts a filter, matching refetch fetching one page and
selecting by id client-side.

* Fix live agent updates in directories without a registered workspace

The opaque-ID work removed buildProjectPlacementForCwd's directory
fallback, so an agent running in a folder with no registered workspace
(e.g. a fresh non-git dir) produced a null placement. forwardAgentUpdate
then threw "Workspace not found", the error was swallowed by its catch,
and no agent_update was emitted — live model/thinking switches and status
updates silently stopped. Caught by the live-preferences e2e suite.

The fallback builds a directory-scoped project placement keyed by the
path. That key is a project grouping key (non-git projects group by
path), not a workspace id, so it stays within the opaque-id rule.

* Always run server worktree archive, even without a resolved workspace

Archiving bailed out entirely when the workspace was not found in the
client store, so a race or stale state could make "archive" do nothing
server-side with only a console.warn. The server archive is keyed by
worktreePath, which is always available, so it now runs regardless; only
the optimistic client-side updates (keyed by workspace id) are gated on
the workspace being resolved.

* Expect a directory-scoped placement for unregistered agent dirs

This unit test asserted the no-placement behavior reverted in the live
agent-update fix, which had broken live model/thinking switching. Update
it to expect the directory-scoped placement now emitted for an agent in a
directory with no registered workspace.

* Fix opaque workspace routing in app E2E

* Preserve workspace IDs during partial bootstrap

* Fix archive flows for opaque workspace IDs

* Stop treating opaque workspace IDs as filesystem paths

Workspace IDs are opaque (wks_<hex>), but several call sites still passed
the id where a directory was expected, which broke those flows for opaque
IDs. The branch switcher sent the id as a cwd to branch/stash/checkout git
operations, and server archive/reconcile cleanup keyed git-watch and
subscription teardown by id, leaking that state.

Git and filesystem operations now take the workspace directory; the opaque
id is used only for identity and cache keys. Archive/reconcile cleanup
routes through a single teardownArchivedWorkspace helper that keeps the key
split explicit: runtime store by id, git watch and subscription by cwd.
Path-derived grouping keys are renamed to directory keys, and the helpers
are split into workspace-identity and workspace-directory so the id-vs-path
boundary is obvious.

packages/app/src/utils/workspace-identity.test.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import type { WorkspaceDescriptor } from "@/stores/session-store";
+import {
+  resolveWorkspaceIdByDirectory,
+  resolveWorkspaceMapKeyByIdentity,
+  resolveWorkspaceRouteId,
+} from "./workspace-identity";
+
+function createWorkspace(
+  input: Partial<WorkspaceDescriptor> & Pick<WorkspaceDescriptor, "id">,
+): WorkspaceDescriptor {
+  return {
+    id: input.id,
+    projectId: input.projectId ?? "project-1",
+    projectDisplayName: input.projectDisplayName ?? "Project",
+    projectRootPath: input.projectRootPath ?? "/repo",
+    workspaceDirectory: input.workspaceDirectory ?? "/repo",
+    projectKind: input.projectKind ?? "git",
+    workspaceKind: input.workspaceKind ?? "checkout",
+    name: input.name ?? "main",
+    status: input.status ?? "running",
+    archivingAt: input.archivingAt ?? null,
+    statusEnteredAt: null,
+    diffStat: input.diffStat ?? null,
+    scripts: input.scripts ?? [],
+  };
+}
+
+describe("resolveWorkspaceRouteId", () => {
+  it("trims route workspace ids without path normalization", () => {
+    expect(resolveWorkspaceRouteId({ routeWorkspaceId: "  C:\\tmp\\repo\\  " })).toBe(
+      "C:\\tmp\\repo\\",
+    );
+  });
+
+  it("returns null for empty values", () => {
+    expect(resolveWorkspaceRouteId({ routeWorkspaceId: "   " })).toBeNull();
+  });
+});
+
+describe("resolveWorkspaceIdByDirectory", () => {
+  it("matches workspace directories", () => {
+    const workspaces = [
+      createWorkspace({
+        id: "workspace-1",
+        projectRootPath: "/repo",
+        workspaceDirectory: "/repo/.paseo/worktrees/feature",
+      }),
+    ];
+
+    expect(
+      resolveWorkspaceIdByDirectory({
+        workspaces,
+        workspaceDirectory: "/repo/.paseo/worktrees/feature",
+      }),
+    ).toBe("workspace-1");
+  });
+
+  it("does not match project root metadata", () => {
+    const workspaces = [
+      createWorkspace({
+        id: "workspace-1",
+        projectRootPath: "/repo",
+        workspaceDirectory: "/repo/.paseo/worktrees/feature",
+      }),
+    ];
+
+    expect(
+      resolveWorkspaceIdByDirectory({
+        workspaces,
+        workspaceDirectory: "/repo",
+      }),
+    ).toBeNull();
+  });
+});
+
+describe("resolveWorkspaceMapKeyByIdentity", () => {
+  it("returns the existing map key when the identity already matches a key", () => {
+    const workspaces = new Map<string, WorkspaceDescriptor>([
+      [
+        "workspace-1",
+        createWorkspace({
+          id: "workspace-1",
+          workspaceDirectory: "/repo/.paseo/worktrees/feature",
+        }),
+      ],
+    ]);
+
+    expect(
+      resolveWorkspaceMapKeyByIdentity({
+        workspaces,
+        workspaceId: "workspace-1",
+      }),
+    ).toBe("workspace-1");
+  });
+
+  it("does not resolve workspace directories when an id is required", () => {
+    const workspaces = new Map<string, WorkspaceDescriptor>([
+      [
+        "workspace-1",
+        createWorkspace({
+          id: "workspace-1",
+          workspaceDirectory: "C:\\repo\\feature\\",
+        }),
+      ],
+    ]);
+
+    expect(
+      resolveWorkspaceMapKeyByIdentity({
+        workspaces,
+        workspaceId: "C:/repo/feature",
+      }),
+    ).toBeNull();
+  });
+});