kernel: WorkspaceService — init/open workspace on disk, format_version, project-name uniqueness

[JArmandoAnaya]

Context

The workspace is the root of everything: a directory on disk plus its metadata store. Every
kernel operation happens in the context of exactly one workspace.

Deliverables

• WorkspaceService.init(path) — creates directory layout (blob store root, sqlite db),
  writes format_version.
• WorkspaceService.open(path) — validates layout + format_version, fails with a clear
  error on unknown/future versions.
• Project-name uniqueness enforced at workspace level.
• Wire FilesystemBlobStore + SqliteMetadataStore construction here (single composition
  point for default adapters).

Acceptance criteria

• init on an existing non-empty dir fails safely; open on a non-workspace dir fails clearly
• Duplicate project names rejected with a domain error
• Tests cover init/open/reopen against tmpdir

[JArmandoAnaya]

Heads-up from #3 (PR #74): format_version now lives in the _visionset_meta table inside the workspace database, and SqliteMetadataStore.initialize() already runs pending migrations and raises WorkspaceFormatTooNew when the file is stamped ahead of the build. store.format_version reads it back (0 = never initialized).

So WorkspaceService.open() validates the directory layout — blob-store root, db file present, not an arbitrary folder — and delegates the version check by calling initialize(). No second version concept is needed, and migration 002 gets picked up automatically. SqliteMetadataStore + FilesystemBlobStore construction is still unwired; #4 is the single composition point.