feat(storage): add built-in centralized workspace isolation

[Grivn]

摘要 / Summary

新增内置 storageScope: workspaces：所有本地记忆区域集中存放在固定根目录下，同时按工作区隔离。根包 Host 统一解析布局和工作区标识，Core 保持操作范围与 View 权限边界，Source 继续管理自身数据；无需新的存储插件或 SDK API。

Adds built-in centralized workspace storage. Settings exposes the optional central root beside the scope selector; Sidebar inspection, Builtin and Headless use the same workspace-aware routing, with optional global USER.md. Also fixes long-path overflow in the existing Memory Spaces view and keeps the workspace picker visible alongside alignment notices.

关联 Issue 或背景 / Related Issue or Context

Closes #189. Supersedes #215.

按维护者要求放弃独立 storage-plugin 方案，从最新 main 的 820b0b0 创建独立 worktree 重新实现，保留已合入的 Runtime 容量与归档改进。旧分支保留作为历史记录。

Reimplemented from current main in a separate worktree instead of carrying the conflicting plugin branch forward. No new package, dependency, SDK export, CI workflow or release-intent workaround is introduced.

涉及区域 / Affected Areas

• Host 激活、Headless 或 bundle / Host activation, Headless, or bundle
• 运行时记忆 / Runtime Memory
• 项目档案 / Project Documents
• 记忆空间或 Provider / Memory Spaces or Providers
• 子 Agent 或 Agent 工作流 / Subagent or Agent workflow
• Web UI 或对话交互 / Web UI or conversation interaction
• 设置、存储或安全 / Settings, storage, or security
• CLI、RPC、命令或工具 / CLI, RPC, commands, or tools
• 安装、更新或发布 / Installation, update, or release
• 测试、构建或文档 / Tests, build, or documentation
• 其他（请说明）/ Other (explain below)

PR 类型 / PR Type

• 面向用户的功能或行为变更 / User-facing feature or behavior change
• Bug 修复 / Bug fix
• 增强或优化 / Enhancement or optimization
• 兼容性适配 / Compatibility change
• 维护或重构 / Maintenance or refactor
• 测试或构建 / Tests or build

最新代码确认 / Latest Codebase Confirmation

• 我已基于最新 main 分支开发，或在提交前已 rebase 或合并最新 main。 / I developed from the latest main, or rebased or merged the latest main before submitting.

同步命令 / Sync command:

git fetch origin main
git worktree add -b feat/issue-189-core-workspaces ../dsh-mnemon-issue-189-core origin/main
git fetch origin main
git rev-list --left-right --count origin/main...HEAD

提交前结果为 0 3：包含最新 main，新增三个提交，无待解决冲突。 / Final result: 0 3, current with main and three new commits; no unresolved conflicts.

AI 编码披露 / AI Coding Disclosure

• 完全 AI 编码：全部编程改动由 AI 产出。 / Fully AI-coded: AI produced all programming changes.
• 部分 AI 辅助：AI 帮助编写或修改了部分内容。 / Partially AI-assisted: AI helped write or modify part of the change.
• 未使用 AI 编码辅助。 / No AI coding assistance was used.

使用的 AI 模型 / AI model used:

GPT-6

使用的编码 Agent 工具 / Coding Agent tool used:

Codex。代码已由 Agent 自检并完成下述验证；维护者最终审阅待完成。 / Codex. Agent self-review and the checks below are complete; final maintainer review is pending.

仓库规范检查 / Repository Rules

• 未修改 DSH 官方源码，未让 tsconfig 指向 DSH 源码 checkout，仅使用正式的 @deepseek-ai/* NPM 契约。 / I did not modify DSH source or point tsconfig at a DSH source checkout, and used only published @deepseek-ai/* NPM contracts.
• Client 与 Host 边界仍以浏览器安全的 src/host/protocol.ts 为准，没有在两侧重复定义 wire DTO。 / The Client and Host boundary still uses browser-safe src/host/protocol.ts as the source for wire DTOs.
• 持久化格式、RPC 权限、路径或凭据处理的变更包含兼容或拒绝路径、安全分析和相应测试。 / Changes to persistence formats, RPC authority, paths, or credentials include compatibility or rejection paths, security analysis, and tests.
• 没有提交 token、密钥、私有记忆、未脱敏日志或生成的 lib/ 文件。 / I did not commit tokens, credentials, private memory, unredacted logs, or generated lib/ files.
• 用户可见文案和长期文档已同步维护中文与英文版本，命令、配置键和路径保持一致。 / User-facing copy and long-lived documentation are synchronized in Chinese and English, with matching commands, configuration keys, and paths.
• 会改变发布制品或其元数据的 PR 已添加 changeset；仅测试、CI 或站点文档变更可不添加。 / A PR that changes a published artifact or its metadata includes a changeset; test-only, CI-only, and site-documentation-only changes may omit one.
• 新增和修改的代码、注释、文档、提交信息不含 emoji。 / New and modified code, comments, documentation, and commits contain no emoji.

兼容性与数据安全 / Compatibility and Data Safety

• global / workspace / custom 和旧 dataDir 配置保持原语义；新模式使用 <dataDir or global root>/workspaces/<SHA-256 of canonical workspace path>/，统一承载 runtime、data、documents、state。 / Existing scopes and legacy configuration retain their semantics; all four local areas share the selected workspace subtree.
• 符号链接别名共用标识和运行时实例。重命名或移动选择新目录；切换范围不会迁移、合并或删除旧数据。5 个实际控制文件在根目录和展示位置切换前后保持相同 SHA-256。 / Aliases share an identity and generation; moves select a new directory without modifying old roots.
• USER.md 仅在显式选择 runtimeUserScope: global 时共享；远端 Provider 保留自身命名空间语义。未改变格式、写入事务或 Provider SDK。 / Global USER.md remains opt-in; remote namespace semantics and persistence formats remain unchanged.
• 相对路径、空字节和未注册工作区被拒绝。测试使用临时 Profile、合成记忆和 loopback 模型，未访问真实账号。 / Invalid paths and unauthorized workspace IDs are rejected; tests used isolated synthetic data.
• 根包未压缩体积由 main 的 1,249,360 增至 1,256,247 字节，文件数保持 46；审计确认没有打入 Source/Provider 实现，上限小幅调整到 1,260,000。 / Audited growth is 6,887 bytes; package count and implementation boundaries are unchanged.

本地验证 / Local Validation

执行的命令 / Commands run:

MNEMON_NATIVE_TEST_CLI=/opt/homebrew/bin/mnemon npx --yes --package=node@22.19.0 --package=pnpm@10.13.1 --call 'pnpm run verify'
npx --yes --package=node@22.19.0 --package=pnpm@10.13.1 --call 'node scripts/verify-plugin-artifacts.mjs --skip-build'
CHANGESET_BASE_REVISION=820b0b092fe68eb7ce6fbf1eaa12e9cf39087e31 npx --yes --package=node@22.19.0 --package=pnpm@10.13.1 --call 'pnpm run release:intent'
npx --yes --package=node@22.19.0 --package=pnpm@10.13.1 --call 'pnpm e2e:serve'

结果摘要 / Result summary:

• 完整验证通过：根包 852 个测试、独立插件 324 个测试；真实 Native 0.2.7 和 Headless 启动/重启、确定性构建、类型检查、公开出口和包检查通过。 / Full verification passed, including the latest main's 23 capacity-workflow tests.
• 16 个独立插件仓库、17 个 tarball 验证通过，包括真实 DSH 仅安装根包后激活全部插件。 / Standalone packed consumers and root-only Starter activation passed.
• 5 个 opt-in Flash 检查未开启；1 个 Windows 专属二进制冒烟在 macOS 跳过。没有把固定回复模型作为真实沉淀质量验收。 / Five live Flash checks and one Windows-only check were skipped; scripted UI replies do not establish model quality.
• 真实 WebUI 覆盖 A/B 隔离、全局 USER.md、档案、Holographic 配置、Native 数据库、默认根回退、恢复原根、Builtin 双会话、Host 重启和 Sidebar 对齐；中英文、深浅色及 390px 检查完成。 / Real UI exercised persistence and routing end to end. Final canvas client/scroll widths matched on desktop and narrow screens.
• 两个截图发现的布局问题已修复，最终源码检查再次完整通过；临时环境和浏览器均已清理。 / Screenshot-discovered layout issues were fixed and reverified; temporary state was removed.

用户可见变更证据 / Local Feature Evidence

证据 / Evidence:

完整验证与 9 张截图 / Full report and nine screenshots · 中文记录

功能版本 2314d6a，最终布局与自动化版本 51446b5。截图全部来自新 Core/Host 分支，具体 revision 映射见报告。 / All evidence was captured from the new built-in implementation; the report identifies each tested revision.