Add a portable workspace delta contract

[chubes4]

Summary

Give WP Codebox a typed portable workspace-delta handoff while Homeboy remains the sole apply, verification, promotion, and publication owner.

What changed

• Add workspace-delta/v1 with portable changed-file and patch references, include it in the canonical headless result, reject host, UNC, traversal, and inferred filenames, and export the contract through runtime-core.

How to test

1. Run npm run build; expect All runtime and CLI TypeScript packages compile..
2. Run npm run test:agent-task-contracts; expect Canonical agent-task, evidence, workflow interface, source materialization, and reusable workflow tests pass..

Compatibility

The canonical headless result gains a required workspace_delta field. Consumers of that typed result must accept the added field; lifecycle and publication ownership remain unchanged in Homeboy.

Evidence

• Base unchanged since verification: main remains at a2b02cd.
• Reviewer-resolvable source evidence: Make WP Codebox a thin Homeboy execution target #1827
• Verified finalization base: main at a2b02cd
• build: Passed
• contract-tests: Passed
• diff-check: Passed

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode
• Model: openai/gpt-5.6-sol
• Used for: Completed the portable workspace-delta contract, path-safety validation, exact-base rebase, and verification with Chris.

Source relationships

• Relates to Make WP Codebox a thin Homeboy execution target #1827