cfctl v1.3.1 — efficient workspace discovery

Workspace operation discovery now selects repositories by their committed operation identity before inspecting the selected source. This removes repeated full workspace graph scans that could make Maildesk compatibility checks exceed their timeout in a large registered workspace. Duplicate ownership, nested repository boundaries and selected-source integrity checks remain enforced.

This is a source release. Build and install from the tagged checkout using ./bootstrap.sh. No prebuilt binaries or signed installers are attached; Apple notarization is not needed for the local source-build workflow.

Validation: independent review and the complete native gate passed on 72261cb9c6d3b54de77f7fc9295756284d567a63 (PR #201), including 495 runtime tests, public CLI/workspace checks, clean site reproducibility and Linux cross-compilation. Both Maildesk compatibility modes passed against the repaired candidate and actual registered workspace, with catalog lookup reduced from 13–20 seconds to 2.36–2.65 seconds.