Add registered workspaces and Windows test hardening

[quantrobs]

Summary

• Add registered host workspaces (RW0–RW2) so Pilot/API can bind allowlisted Windows paths without accepting raw absolute workdir values.
• Wire console Pilot workspace select + Auth registration UI, Programs bind, and CLI workspaces / run --workspace-id.
• Harden Windows local-exec tests: portable add-gitignore-entry seed, POSIX mode-bit skips, and symlink-privilege skips.

Test plan

• pytest tests/unit/test_registered_workspaces.py tests/unit/test_gitignore_seed_local_exec.py -v
• Register a workspace and submit a Pilot run against a real checkout
• Confirm absolute workdir without workspace_id still returns 400
• On Windows: previously failing chmod/symlink tests skip cleanly; m1 apply + skills promote pass

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.