Workspace-first release with explicit runtime and access controls.
Highlights:
- spawn, spawn codex, spawn -C PATH, and spawn -- COMMAND as the primary launch model
- explicit access profiles: minimal, git, trusted
- explicit runtime modes: auto, spawn, workspace-image with caching and rebuild control
- richer spawn doctor output including JSON
- expanded smoke coverage and hardening for auth handling, image detection, and CLI routing