feat: add capability-scoped agent workspaces

[kauandotnet]

Summary

• add a backend-neutral mounted workspace capability with canonical logical paths, permissions, quotas, opaque cursors, and ETag-conditional mutations
• add an optional AI SDK 7 ToolSet adapter for request-scoped Nest agents
• harden filesystem and S3 conditional mutations and fix destination-prefixed sync
• document the security boundary and deployment constraints

Validation

• 109 unit tests
• 22 E2E tests passed, 1 skipped
• typecheck, oxlint, Prettier, publint, build, pack, and packed consumer checks
• isolated packed integration with @nestm/ai-sdk using a real mock ToolLoopAgent tool call

Release

Includes a Changesets entry for @nestm/storage@0.1.0-alpha.7.