The PATH- and MACHINE-independent workspace id, byte-identical to h2a 0.63.0 (the
a2a-cli/h2a maintainer pinned + shipped it; track agreed to align). Closes the
workspace-string fragility (cwd-change + local<->remote divergence) flagged in the
track<->h2a RACI thread.

- computeDurableWorkspaceId(root, rel) = 'ws:' + sha256hex(root + '\n' + rel)
  (pure); durableWorkspaceId(cwd) does the git I/O (rev-list --max-parents=0 HEAD,
  multiple roots sorted+comma-joined; rel='' for main worktree else basename of
  --git-dir; non-git -> undefined, no machine+path fallback).
- CLI: track workspace-id [--cwd]. Exported from the public surface.
- h2a's published test vectors are the CONFORMANCE GATE (green) so both sides stay
  byte-identical; track's workspaceActivity poll + h2a's conductor resolver key on
  the SAME id.

Additive (helper + CLI; does not yet change how ingest sets workspace). Event
contract / write path / P0 guard untouched. 442 tests. 0.10.7.