feat: align wspace surfaces with git-native conventions and fail-closed checks (#9, #11-#17)

[EthanThatOneKid]

Resolves #9, #11, #12, #13, #14, #15, #16, #17

Summary of Changes

• Fix duplicate unmanaged repository reporting in wspace check #17 & Align \wspace\ surfaces with git-native conventions (baseline default in help, \check\ unmanaged double-listing, \--stale\ docs) #9 (Unmanaged Scan & CLI Help): Filtered directory scan in collectStatus() so manifest-managed repos are not double-listed as (unmanaged) . Documented origin/ baseline default and --stale semantics in CLI usage text.
• Make wspace init reject non-Git paths and report clone failures #11 (Fail-Closed init / sync): Existing non-Git paths report PATH_BLOCKED, clone failures report CLONE_FAILED with stderr details, and init/sync exit non-zero on failure.
• Resolve relative workspaceRoot values from the manifest directory #12 (Relative workspaceRoot Resolution): Relative workspaceRoot values resolve against the manifest file directory.
• Report linked worktree health in wspace check #13 (Linked Worktree Health): wspace check inspects linked feature worktrees and reports branch, path, detached state, clean/dirty status (WORKTREE_DIRTY), missing directories, or Git errors.
• Validate manifest paths and fail closed on Git inspection errors #14 (Path Traversal & Security Boundaries): Added validateSafeName() and validateSafePath() to reject path traversal and invalid characters.
• Document the beginner worktree lifecycle and path-resolution rules #15 (Beginner Worktree Lifecycle Docs): Added 8-step lifecycle guide, \C:\Users\ethan\Documents\wazootech\workspace\worktrees\workspace-cli\wspace-updates worktree path resolution rules, and troubleshooting to README.md.
• Add dry-run and safe permissions to wspace env sync #16 (wspace env sync --dry-run & Permissions): Added --dry-run flag support, rejected symlinks at destinations, applied 0600 owner-only permissions on copied credential files, and returned exit code 1 on copy failures.

Verification

• deno task ci passed cleanly (53 tests passed, zero lint/formatting/type errors).