Hotfix: separate workspace observation from lock claim — restore artifact projector for cognitive runs

Production regression of T1 (7829acc..15e3863). User reports "明明生成
了很多文件,但只有一个" — the filesystem shows 19 markdown deliverables
in ~/Documents/Github/test/{business-plan,operations,ceo-coordination}/
but the DocumentCenter surfaces only one row.

Root cause is structural, predicted in spirit by Karpathy's Round 1
take ("把'认知'和'执行'两件事一起锁是数据结构错"). The T1 rewrite
collapsed two concerns into one nullable field on the run context:

  workspacePath = workspace?.localPath ?? null
                  ^^^^^^^^^                ^^^^
                  lock target              observation root

For lockMode='none' (every cognitive C-suite agent post-T1) the
resolver returns workspace=null, so workspacePath was null, so
artifact-projector.ts:242 short-circuited every projection with
`{ kind: "skipped", reason: "no_workspace" }`. The agents kept
writing files via bash (cwd falls back to the company default
workspace at worker/runtime/index.ts:142), but nothing observed
them — the DocumentCenter only saw the one file that was projected
back when the agent still held an exclusive workspace.

Fix: split the two concerns. WorkspaceResolution gains a non-lock
`observationPath` field; the resolver populates it from the company
primary workspace (new `getCompanyObservationWorkspace` query —
primary first, oldest second, null only when company has zero
workspace rows) for lockMode='none' runs, and from `workspace.localPath`
itself for lockMode='exclusive' runs. RunDispatchParams threads the
field through; turn-context's `workspacePath` reads it first.
artifact-projector.ts is unchanged — it just sees a non-null path
again and resumes baselining, diffing, and upserting work_products
rows the way it did pre-T1.

Three new unit tests pin the regression: cognitive role with
workspace ⇒ observationPath set; cognitive role with no workspace ⇒
observationPath null; exclusive ⇒ observationPath equals
workspace.localPath. typecheck green, 543/543 unit tests, 10/10
eval. No fallback, no mock, no silent degradation.

src/main/database/workspaces.ts

@@ -61,6 +61,28 @@ export function buildWorkspaceMethods(
       return row ? { ...row, isPrimary: toBoolean(row.isPrimary) } : null;
     },
 
+    /**
+     * Pick a single workspace per company for *observation only* (no
+     * lock claim). Used by the artifact projector to know where on
+     * disk a `lockMode='none'` cognitive run might write files. The
+     * tie-break order is `is_primary` first, then earliest `created_at`
+     * — i.e. the workspace the operator marked as canonical wins, and
+     * if no one is marked, the oldest row wins (which historically is
+     * the company's default scratch directory).
+     *
+     * Returns `null` when the company has no workspace at all; the
+     * caller treats that as "agent has no observation surface", which
+     * is correct — there is genuinely nowhere to look for files.
+     */
+    getCompanyObservationWorkspace(companyId: string): WorkspaceRecord | null {
+      const row = getDb()
+        .prepare(
+          "select id, company_id as companyId, name, local_path as localPath, repo_url as repoUrl, repo_ref as repoRef, project_id as projectId, state, is_primary as isPrimary, created_at as createdAt, updated_at as updatedAt from workspaces where company_id = ? order by is_primary desc, created_at asc limit 1",
+        )
+        .get(companyId) as WorkspaceRecord | undefined;
+      return row ? { ...row, isPrimary: toBoolean(row.isPrimary) } : null;
+    },
+
     listWorkspaceLocalPaths(companyId: string): string[] {
       const rows = getDb()
         .prepare("select local_path as localPath from workspaces where company_id = ? and local_path is not null")