quality(workspace): dedupe workspace_store_image and workspace_pick_and_store_image (R1.4)

[juacker]

Implements R1.4 from the roadmap. Source: finding F4 of docs/arch-review-r1-workspace-rs.md.

Problem

workspace_store_image and workspace_pick_and_store_image in src-tauri/src/commands/workspace.rs duplicated ~15 lines each:

• resolving the agent workspace root out of AppState (lookup + error mapping + PathBuf clone),
• an identical trailer building the ContentPart::Image return value (write bytes, build relative path, assemble the part).

Change

Two helpers, both private to the module:

• fn resolve_agent_workspace_root(state: &AppState, workspace_id: &str) -> Result<PathBuf, String> — owns the clone; returning &Path would tie the borrow to the AppState guard.
• async fn store_workspace_image(root: &Path, bytes: &[u8], media_type: &str, filename: Option<String>) -> Result<ContentPart, String>

Both commands now call them. No behaviour change; error strings and the returned ContentPart shape are preserved.

Net: +50/-38, one file.

Verification

Run from src-tauri/:

• cargo fmt --check — clean
• cargo clippy --lib -- -D warnings — clean
• cargo test --lib — 941 passed, 0 failed

Note: this is a re-land

The original commit 0aa9a16 was accidentally pushed directly to main on 2026-08-05 (a git checkout -b <new> origin/main set branch.<new>.merge = refs/heads/main, so a later git push -u resolved to main). It was reverted in d680a96, which is in main. This PR re-applies the same change as a fresh commit on top of 75fd6a4. PR #151 was closed as unsalvageable — its head was an ancestor of main, so GitHub refused to retarget it.

Branch protection on main has since been tightened to require a pull request and passing status checks.