fix: validate wrapped external workspace config files

[christso]

Summary

AgentV supports workspace: ./path/to/workspace.yaml, but if the referenced file accidentally wraps the config under a top-level workspace: key, the parser currently treats it as an empty workspace config instead of failing clearly.

Repro

Eval file:

workspace: ../.templates/eval-workspace-setup.yaml

Referenced file:

workspace:
  isolation: per_test
  hooks:
    before_each:
      reset: fast

Actual

The external workspace file is silently ignored because AgentV expects the referenced file to contain the bare workspace config object.

Expected

AgentV should fail validation with a clear error telling the user that external workspace files must contain the workspace config directly and should not include the top-level workspace: wrapper.

Why this matters

This is easy to do when extracting a shared workspace block from an eval into a reusable template file. The current behavior looks like workspace setup is broken instead of surfacing the real authoring mistake.