Fix pipeline compile failure for workspace embedding

[YspCoder]

Motivation

• 修复 CI 编译失败：cmd/clawgo 包内的 //go:embed workspace 无法找到仓库根目录的 workspace 目录，导致全量构建失败。
• 需要将嵌入资源放在包含 workspace 目录的包中并导出以供 cmd/clawgo 使用。

Description

• 新增 workspace_embed.go，在根包 clawgo 使用 //go:embed all:workspace 导出 EmbeddedWorkspace（类型为 embed.FS）。
• 将 cmd/clawgo/main.go 中原先的 //go:embed workspace 替换为引用 clawgo.EmbeddedWorkspace。
• 移除 cmd/clawgo/cmd_status.go 中未使用的 time 导入以确保全包编译通过。

Testing

• 运行 go test ./...，所有包成功构建并通过测试，命令执行成功。

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1baf67ce6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove all: from workspace embed pattern

Using //go:embed all:workspace changes the embed semantics to include dot/underscore files (per go doc embed), so hidden files like workspace/skills/context7/.env are now compiled into the binary and then copied out by copyEmbeddedToTarget during onboard. This is a security/config regression introduced by this commit because sensitive or build-local hidden files can be unintentionally distributed to end users; use workspace (or an explicit allowlist) to preserve the prior exclusion of hidden files.

Useful? React with 👍 / 👎.