MOO-72 Commit 6: harden secure temporary workspaces and artifact lifecycle

[OwenTanzer]

Summary

• WorkspaceManager gains a per-process instances/<bootId>/ namespace (a fresh randomUUID() per process) + PID lock file, and an ownership marker (.codeflow-owned-v1) written once by ensureRoot().
• New sweepStaleWorkspaces(): process-restart cleanup. Only removes other instance directories confirmed not-alive via process.kill(pid, 0) — a live overlapping instance (e.g. mid rolling-deploy, or any two processes sharing a root) is never touched. Refuses to run at all against a root lacking the ownership marker, and only ever considers UUID-shaped entries under instances/ — a WORKSPACE_ROOT ever misconfigured to point at a shared/non-dedicated directory has none of its unrelated contents touched.
• The workspace object returned by createRequestWorkspace gains writeFile()/copyTree() as the only sanctioned way to put content into it:
  • writeFile(): walks every ancestor path component for a symlink (not just the immediate parent), then an atomic wx (O_CREAT|O_EXCL) exclusive-create write — closes both the TOCTOU race between checking and writing, and the case where the final target itself already exists as a symlink (a realpath-only parent check would miss this entirely). Private file/dir permissions (0600/0700).
  • copyTree() (for analyze.js's local-tree path, a second workspace-materialization path distinct from pyan3's per-file writes): rejects — aborts the whole copy — if the source tree contains any symlink at all, rather than silently dereferencing or skipping. Recursively tightens permissions on everything copied.
• stagePythonFiles (pyan3Adapter.js) and analyze.js's cp() call both now route through these instead of their own raw mkdir/writeFile/cp.
• No diagnostic-artifact retention mechanism added — documented in docs/baseline.md as a deliberate policy: every diagnostic stays in-memory/response-only, consistent with "avoid retaining private source longer than necessary" right next to it in the same checklist entry.
• CodeVisualizer's function-layer analysis is confirmed (and documented) to never touch disk at all — no second, parallel workspace implementation exists to reconcile.

Test plan

• npm test — 672/673 passing (1 expected skip: file-symlink creation isn't permitted in this Windows dev environment without Developer Mode — the equivalent junction-based ancestor-symlink test and the copyTree symlink-rejection test both pass for real)
• Real (not synthetic) crash-cleanup test: spawns an actual child process that creates a real workspace via the real WorkspaceManager and hard-exits without running its own cleanup(), then confirms the next process's real startup sweep removes it.
• Real signal-driven abort test: drives runSharedPyan3Analysis with a real AbortController that fires almost immediately, confirming the actual execFile-level kill path still leaves the shared workspace cleaned up.
• Overlap safety: an instance directory whose lock file names this test process's own (guaranteed-alive) PID is never removed by sweepStaleWorkspaces(); one naming a confirmed-dead PID (a real spawned-then-exited child) is removed.
• Ownership-marker gating: a root without the marker makes the sweep a no-op; unrelated files/directories outside instances/ on an owned root are never touched.
• Ran the real end-to-end smoke test (tests/server-smoke.mjs) against the actual server process — all 22 steps pass, including the updated "every per-request workspace was cleaned up" assertion (now checking this instance's own namespace is empty, since the root legitimately carries the ownership marker + instances/ for the process's lifetime) and confirming analyze.js's new copyTree() path still matches the golden-world baseline exactly (files:6 functions:7).

🤖 Generated with Claude Code

[linear-code]

MOO-72

[OwenTanzer]

Not ready to merge yet: two blocking issues.

[OwenTanzer]

Review complete: both blocking fixes are verified, the final thread is resolved, the full local suite and production build pass, and all GitHub Actions checks are green. Ready to merge.