feat(cli): rename sync-* commands to workspace-* with aliases and implement rbash restricted mode

[tusharmath]

Summary

Rename sync-* CLI commands to workspace-* (with backward-compatible aliases), implement restricted shell mode via rbash, and remove the bounty automation system.

Context

The sync-* commands lacked a clear namespace, making it harder to discover related workspace commands. Grouping them under a workspace-* prefix improves consistency and discoverability. Additionally, the --restricted flag previously relied on a permissions feature; it now uses rbash (restricted bash) directly for a simpler, more reliable security boundary. The bounty automation system (GitHub Actions workflow, TypeScript scripts, and Rust CI code) has been removed as it is no longer needed.

Changes

Command Renaming (workspace-* prefix)

• sync → workspace-sync (old name kept as an alias)
• sync-init → workspace-init (old name kept as an alias)
• sync-status → workspace-status (old name kept as an alias)
• sync-info → workspace-info (old name kept as an alias)
• Updated built_in_commands.json descriptions to reflect new names and aliases
• Updated the shell plugin dispatcher (dispatcher.zsh) to handle both old and new command names

Restricted Shell Mode

• ForgeCommandExecutorService now accepts a restricted: bool parameter
• When restricted = true and not on Windows, the executor uses rbash instead of the user's configured shell
• Updated the --restricted / -r CLI flag description to accurately reflect the rbash behavior
• Added a doc comment to the shell tool service clarifying the restricted bash behavior
• Propagated the restricted flag through ForgeInfra

Bounty Automation Removal

• Removed .github/scripts/bounty/ directory (TypeScript source and tests)
• Removed .github/workflows/bounty.yml
• Removed crates/forge_ci/src/workflows/bounty.rs and crates/forge_ci/src/jobs/bounty_job.rs
• Removed associated npm scripts (test:bounty, bounty:sync-issue, bounty:sync-pr)

Testing

# Verify workspace-* commands work
forge workspace-sync
forge workspace-status
forge workspace-info
forge workspace-init

# Verify old sync-* aliases still work
forge sync
forge sync-status
forge sync-info
forge sync-init

# Verify restricted shell mode
forge --restricted -p "run: echo hello"   # Should execute via rbash

# Run crate tests
cargo insta test --accept -p forge_infra
cargo insta test --accept -p forge_main
cargo insta test --accept -p forge_ci