fix(workspace): make Release idempotent (audit #14.2)

[sbalabanov]

Summary

Audit #14.2. Make workspace release idempotent so a worker slot can be returned to its pool at most once.

Intent

Protect cleanup paths from duplicate or concurrent Release calls that could return the same workspace slot multiple times or block on a full pool channel.

Changes

• Guard the release callback with sync.Once.
• Document the idempotent Release contract.
• Cover sequential and concurrent repeated releases.

Test Plan

• go test -race ./core/workspace
• ./tools/bazel test //core/workspace:workspace_test --test_output=errors --test_env=GIT_CONFIG_COUNT=1 --test_env=GIT_CONFIG_KEY_0=commit.gpgsign --test_env=GIT_CONFIG_VALUE_0=false
• make gazelle
• aifx verify

Revert Plan

Revert this PR to restore the previous repeatable release callback behavior.

Jira Issues

None.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}