Rewrite resolveWorkspace to per-task lockMode inference; drop company_fallback silent share (B4-adjacent)

Old resolver: task → agent → project → any company workspace, all
marked exclusive. That fourth step folded every runnable agent in a
multi-agent company onto a single workspace row and serialised the
C-suite (four agents, one exclusive lock, three starved).

New resolver: lockMode='exclusive' is now an opt-in decision inferred
per task. Three rules:

  1. task.workspaceId set → exclusive on that workspace (explicit).
  2. filesystem signal (task.requiresFilesystem OR agent in a
     coding role/engineering department) → exclusive on
     agent.workspaceId / project primary; throws if neither exists.
  3. otherwise → none / null. Pure cognitive work runs with no
     workspace lock and fully in parallel.

Removed:
  - company_fallback silent-share path. Filesystem-touching runs
    with no legitimate binding now throw WorkspaceConfigurationError
    at resolve time so the caller decides recovery rather than the
    resolver picking a random shared workspace.
  - workspacesMod.getAnyCompanyWorkspace (now dead code).

Invariants now enforced by types:
  - lockMode='exclusive' ⇒ workspace is a live WorkspaceRecord.
  - lockMode='none'      ⇒ workspace is null.

Tests updated to cover the new decision table and the four-non-
coding-agents parallel case that was the original bug.

scripts/codemod/remove-appdatabase-passthrough.mjs

@@ -322,7 +322,6 @@ const METHOD_TO_MODULE = {
   getWorkspace: "workspacesMod",
   getProjectPrimaryWorkspace: "workspacesMod",
   listWorkspaceLocalPaths: "workspacesMod",
-  getAnyCompanyWorkspace: "workspacesMod",
   deleteWorkspace: "workspacesMod",
   acquireWorkspaceLock: "workspacesMod",
   claimWorkspaceLock: "workspacesMod",